Cloudanix VulnDB

CVE-2026-109829

High · 7.4

CVSS

7.4

EPSS

0.1%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how certain Node.js HTTP libraries handle redirects and caching can let an attacker trick the system into storing and serving the wrong web content or private information to users.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

When an originless Agent uses redirect then cache interceptors with a shared store, the cache key is derived from the pre-redirect URL, allowing a cross-origin response to be stored under a trusted origin's key and later served to other callers, or a private redirect response to be cached under the original URL and disclosed to unauthenticated users.

Why it matters to the business

Organizations using affected Node.js packages on Red Hat may face unauthorized disclosure of private user data and persistent cache poisoning that serves attacker-controlled content under trusted domains, increasing operational risk and compliance exposure until patches are applied.

How an attack unfolds

An attacker who can influence a redirect target from a trusted URL causes their response to be cached under the trusted origin's key due to the key-construction flaw; subsequent requests for the trusted URL then receive the poisoned or private content. The same mechanism allows private responses to be stored and later served to unauthenticated callers. No public exploitation is known at this time.

How to fix it

Upgrade nodejs24-main to 24.21.0-1.5.hum1 or later and nodejs26-main to 11.20.0-1.26.11.1.0.4.hum1 or later via the referenced Red Hat advisories. As a workaround, reorder interceptors to place cache before redirect, use per-origin dispatchers and stores, or disable shared caching for redirect-capable requests.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases listed in RHSA-2026:84706, confirm interceptor ordering in application code, and test that cache keys incorporate origin after redirects.

Typical attack path

  1. Identify an application using an originless Agent with redirect-then-cache interceptor composition and a shared cache store.
  2. Control or influence a redirect target from a trusted URL handled by the application.
  3. Trigger a request that follows the redirect so the response is stored under the original trusted URL's cache key.
  4. Wait for or induce subsequent requests from other users or unauthenticated callers to retrieve the poisoned or private cached response.

How to detect it

Review application logs for unexpected cache hits on URLs that perform redirects, inspect cache store contents for mismatched origins, and correlate request patterns that involve cross-origin redirects followed by cache retrievals.

What your security team should do

  • Apply the fixed Red Hat packages immediately given the 14-day publication window.
  • Audit all undici-based HTTP clients for the vulnerable interceptor ordering and shared cache configuration.
  • Implement per-origin cache stores or disable shared caching on redirect paths until upgrades are complete.
  • Monitor for cache-related anomalies in application logs after remediation.

The record

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities