Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS

undici (Node.js)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

nodejs/undici shipped coordinated security releases 7.30.2 and 8.12.4 on Nov 5 2026 fixing six advisories. High GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 lets an originless Agent with compose(redirect(), cache()) and a shared cache poison or disclose across users because only the final redirect hop was checked, so intermediate hops could bypass the earlier CVE-2026-109829 fix (affected >=7.30.1 <7.30.2 and >=8.12.2 <8.12.4). Five Medium issues in the same release cover same-origin redirect cache disclosure (GHSA-7xg3-fphp-28hg / CVE-2026-120474), cross-origin redirect revalidation disclosure (GHSA-5rm8-gv32-r954 / CVE-2026-116630), array-of-tuples headers bypassing redirect credential stripping (GHSA-9v6h-8rgp-m69f / CVE-2026-120415), unhandled exception DoS during cache-interceptor response replay (GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222), and Subresource Integrity bypass when integrity metadata uses non-space ASCII whitespace such as a tab (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423). Upgrade to undici 7.30.2 or 8.12.4.

Why this severity: One High (intermediate-hop cache poisoning / cross-user disclosure) plus five Medium (same-origin cache disclosure, cross-origin revalidation disclosure, redirect credential stripping bypass, cache-replay DoS, SRI whitespace bypass)

Started
Nov 5, 2026
CVEs
CVE-2026-116592CVE-2026-120474CVE-2026-116630CVE-2026-120415CVE-2026-120222CVE-2026-120423

Follow this incident

Affected

  • undici >= 7.30.1, < 7.30.2 and >= 8.12.2, < 8.12.4 (GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 high intermediate-hop cache poisoning; narrower than the Medium advisories)
  • undici >= 7.0.0, < 7.30.2 and >= 8.0.0, < 8.12.4 (GHSA-7xg3-fphp-28hg / CVE-2026-120474, GHSA-5rm8-gv32-r954 / CVE-2026-116630, GHSA-9v6h-8rgp-m69f / CVE-2026-120415, GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222)
  • undici >= 7.15.0, < 7.30.2 and >= 8.0.0, < 8.12.4 (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423 SRI whitespace bypass)

Fixed in

  • undici 7.30.2
  • undici 8.12.4

Timeline1

  1. nodejs/undici publishes coordinated security releases 7.30.2 and 8.12.4 with six GitHub advisories covering cache/redirect cross-user disclosure and poisoning, cross-origin redirect credential stripping bypass, Subresource Integrity whitespace bypass, and cache-interceptor DoS.

Advisories8

Posts1
Ulises Gascón
@kom_256

🚨 undici shipped a coordinated security release fixing 6 CVEs (1 high, 5 medium) across 7.x and 8.x: cache/redirect cross-user disclosure and poisoning, a Subresource Integrity bypass, and a denial of service. Upgrade to 7.30.2 or 8.12.4. github.com/nodejs/undici/releases/tag/v8…

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo