undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Impact When interceptors.cache or interceptors.deduplicate is used with a dispatcher that does not carry a single authoritative origin, or when a request supplies its own origin, undici builds the cache and deduplication keys without the actual destination origin. If a cache store or interceptor...

CVE-2026-2581: Allocation of Resources Without Limits or Throttling

This is an uncontrolled resource consumption vulnerability CWE-400 that can lead to Denial of Service DoS. In vulnerable Undici versions, when interceptors.deduplicate is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlle...