undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS ยท updates https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026 nodejs/undici shipped coordinated security releases 7.30.2 and 8.12.4 on Nov 5 2026 fixing six advisories. High GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 lets an originless Agent with compose(redirect(), cache()) and a shared cache poison or disclose across users because only the final redirect hop was checked, so intermediate hops could bypass the earlier CVE-2026-109829 fix (affected >=7.30.1 <7.30.2 and >=8.12.2 <8.12.4). Five Medium issues in the same release cover same-origin redirect cache disclosure (GHSA-7xg3-fphp-28hg / CVE-2026-120474), cross-origin redirect revalidation disclosure (GHSA-5rm8-gv32-r954 / CVE-2026-116630), array-of-tuples headers bypassing redirect credential stripping (GHSA-9v6h-8rgp-m69f / CVE-2026-120415), unhandled exception DoS during cache-interceptor response replay (GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222), and Subresource Integrity bypass when integrity metadata uses non-space ASCII whitespace such as a tab (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423). Upgrade to undici 7.30.2 or 8.12.4. en Thu, 05 Nov 2026 00:00:00 GMT undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS: nodejs/undici publishes coordinated security releases 7.30.2 and 8.12.4 with six GitHub advisories covering cache/redirect cross-user disclosure and poisoning, cross-origin redirect credential stripping bypass, Subresource Integrity whitespace bypass, and cache-interceptor DoS. https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026 https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026#2026-11-05-d6a65c8e Thu, 05 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/nodejs/undici/security/advisories/GHSA-mqg3-3v4r-cm32">Source</a></p>