{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS · updates",
  "home_page_url": "https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026",
  "feed_url": "https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026/feed.json",
  "description": "nodejs/undici shipped coordinated security releases 7.30.2 and 8.12.4 on Nov 5 2026 fixing six advisories. High GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 lets an originless Agent with compose(redirect(), cache()) and a shared cache poison or disclose across users because only the final redirect hop was checked, so intermediate hops could bypass the earlier CVE-2026-109829 fix (affected >=7.30.1 <7.30.2 and >=8.12.2 <8.12.4). Five Medium issues in the same release cover same-origin redirect cache disclosure (GHSA-7xg3-fphp-28hg / CVE-2026-120474), cross-origin redirect revalidation disclosure (GHSA-5rm8-gv32-r954 / CVE-2026-116630), array-of-tuples headers bypassing redirect credential stripping (GHSA-9v6h-8rgp-m69f / CVE-2026-120415), unhandled exception DoS during cache-interceptor response replay (GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222), and Subresource Integrity bypass when integrity metadata uses non-space ASCII whitespace such as a tab (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423). Upgrade to undici 7.30.2 or 8.12.4.",
  "language": "en",
  "_pwn": {
    "slug": "nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026#2026-11-05-d6a65c8e",
      "url": "https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026#2026-11-05-d6a65c8e",
      "title": "undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS: nodejs/undici publishes coordinated security releases 7.30.2 and 8.12.4 with six GitHub advisories covering cache/redirect cross-user disclosure and poisoning, cross-origin redirect credential stripping bypass, Subresource Integrity whitespace bypass, and cache-interceptor DoS.",
      "content_text": "undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS: nodejs/undici publishes coordinated security releases 7.30.2 and 8.12.4 with six GitHub advisories covering cache/redirect cross-user disclosure and poisoning, cross-origin redirect credential stripping bypass, Subresource Integrity whitespace bypass, and cache-interceptor DoS.\n\nSource: https://github.com/nodejs/undici/security/advisories/GHSA-mqg3-3v4r-cm32",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://github.com/nodejs/undici/security/advisories/GHSA-mqg3-3v4r-cm32",
      "tags": [
        "high"
      ]
    }
  ]
}