Origin Validation Error Affecting undici package, versions >=7.30.1 <7.30.2>=8.12.2 <8.12.4

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Origin Validation Error via the cache-handler.js redirect-hop inspection logic when an originless Agent composes the redirect and shared cache interceptors as compose(redirect(), cache()). Undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, bypassing the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted intermediate origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary header is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls the target of a redirect from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller.

Note: This is only exploitable when an originless Agent, a shared cache store, and compose(redirect(), cache()) are all used together.

Compose the interceptors as compose(cache(), redirect()), use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

• GitHub Commit (>=8.12.2 <8.12.4)
• Maintainer's Advisory