CVE-2026-120474

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original...

CVE-2026-120474

The undici HTTP client for Node.js is vulnerable to cross-user disclosure of private responses in versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 . The root cause is a flaw occurring when the redirect interceptor and a shared response cache are used together; an authenticated request redir...