UBUNTU-CVE-2026-116630: Medium severity ubuntu/nodejs vulnerability
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.30.2 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.12.4 - Compensating control
As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using undici 7.0.0 through 7.30.1 or 8.0.0 through 8.12.3 are affected when an Agent composes both redirect and shared cache interceptors. Exposure is most significant where the shared cache can store authenticated responses and later serve requests from unauthenticated callers.
What conditions must an attacker control or trigger?
The origin that stored a cached response must redirect a conditional cache-revalidation request to a different origin. That destination must return a 304 Not Modified, which undici then accepts as validation of the original origin's cached representation.
What can be done before upgrading?
Compose the interceptors as cache then redirect, use separate dispatchers and cache stores for each origin, or disable shared caching for requests that can follow redirects. These measures prevent cross-origin redirect revalidation from validating a shared cached response.
How can I determine whether my application is affected?
Check whether it uses the affected undici versions and composes redirect and shared cache interceptors on an Agent. Also determine whether cached responses may be authenticated, including responses gated by an Authorization header, and whether those requests can be redirected across origins.