GHSA-4w7w-5xrc-9h26Published
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109829 · Microsoft / collected KEV context
cve-program · CVE-2026-109829
- https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26
- https://cna.openjsf.org/security-advisories.html
euvd · EUVD-2026-102309
- https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26
- https://cna.openjsf.org/security-advisories.html
nvd · CVE-2026-109829
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26
osv · GHSA-4w7w-5xrc-9h26
- https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26
- https://nvd.nist.gov/vuln/detail/CVE-2026-109829
- https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8
- https://github.com/nodejs/undici/commit/b20b82ad80a405a12b6ce1f341bcd418de390aa0
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v7.30.1
- https://github.com/nodejs/undici/releases/tag/v8.12.2
Related operational evidence
Explicit CVE identifiers- undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key… · Advisory content revised · 30 Oct 2026
- undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects · Newly collected advisory · 27 Oct 2026