# undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS · pwn.watch > nodejs/undici shipped coordinated security releases 7.30.2 and 8.12.4 on Nov 5 2026 fixing six advisories. High GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 lets an originless Agent with compose(redirect(), cache()) and a shared cache poison or disclose across users because only the final redirect hop was checked, so intermediate hops could bypass the earlier CVE-2026-109829 fix (affected >=7.30.1 <7.30.2 and >=8.12.2 <8.12.4). Five Medium issues in the same release cover same-origin redirect cache disclosure (GHSA-7xg3-fphp-28hg / CVE-2026-120474), cross-origin redirect revalidation disclosure (GHSA-5rm8-gv32-r954 / CVE-2026-116630), array-of-tuples headers bypassing redirect credential stripping (GHSA-9v6h-8rgp-m69f / CVE-2026-120415), unhandled exception DoS during cache-interceptor response replay (GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222), and Subresource Integrity bypass when integrity metadata uses non-space ASCII whitespace such as a tab (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423). Upgrade to undici 7.30.2 or 8.12.4. Page: https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026 · generated 2026-11-06T12:40:28.124Z ## Status - Severity: high · status: live · patch: patched - Product: undici (Node.js) - Started: 2026-11-05 - CVEs: CVE-2026-116592, CVE-2026-120474, CVE-2026-116630, CVE-2026-120415, CVE-2026-120222, CVE-2026-120423 - Affected: undici >= 7.30.1, < 7.30.2 and >= 8.12.2, < 8.12.4 (GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 high intermediate-hop cache poisoning; narrower than the Medium advisories); undici >= 7.0.0, < 7.30.2 and >= 8.0.0, < 8.12.4 (GHSA-7xg3-fphp-28hg / CVE-2026-120474, GHSA-5rm8-gv32-r954 / CVE-2026-116630, GHSA-9v6h-8rgp-m69f / CVE-2026-120415, GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222); undici >= 7.15.0, < 7.30.2 and >= 8.0.0, < 8.12.4 (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423 SRI whitespace bypass) - Fixed in: undici 7.30.2; undici 8.12.4 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026.json - This file: https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: nodejs/undici publishes coordinated security releases 7.30.2 and 8.12.4 with six GitHub advisories covering cache/redirect cross-user disclosure and poisoning, cross-origin redirect credential stripping bypass, Subresource Integrity whitespace bypass, and cache-interceptor DoS. (https://github.com/nodejs/undici/security/advisories/GHSA-mqg3-3v4r-cm32) ## Fix brief # Security brief: undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS Source: https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 12:30 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is nodejs/undici shipped coordinated security releases 7.30.2 and 8.12.4 on Nov 5 2026 fixing six advisories. High GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 lets an originless Agent with compose(redirect(), cache()) and a shared cache poison or disclose across users because only the final redirect hop was checked, so intermediate hops could bypass the earlier CVE-2026-109829 fix (affected >=7.30.1 <7.30.2 and >=8.12.2 <8.12.4). Five Medium issues in the same release cover same-origin redirect cache disclosure (GHSA-7xg3-fphp-28hg / CVE-2026-120474), cross-origin redirect revalidation disclosure (GHSA-5rm8-gv32-r954 / CVE-2026-116630), array-of-tuples headers bypassing redirect credential stripping (GHSA-9v6h-8rgp-m69f / CVE-2026-120415), unhandled exception DoS during cache-interceptor response replay (GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222), and Subresource Integrity bypass when integrity metadata uses non-space ASCII whitespace such as a tab (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423). Upgrade to undici 7.30.2 or 8.12.4. Severity detail: One High (intermediate-hop cache poisoning / cross-user disclosure) plus five Medium (same-origin cache disclosure, cross-origin revalidation disclosure, redirect credential stripping bypass, cache-replay DoS, SRI whitespace bypass) - Product: undici (Node.js) - CVE / advisory ids: CVE-2026-116592, CVE-2026-120474, CVE-2026-116630, CVE-2026-120415, CVE-2026-120222, CVE-2026-120423 ## Affected versions - undici >= 7.30.1, < 7.30.2 and >= 8.12.2, < 8.12.4 (GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 high intermediate-hop cache poisoning; narrower than the Medium advisories) - undici >= 7.0.0, < 7.30.2 and >= 8.0.0, < 8.12.4 (GHSA-7xg3-fphp-28hg / CVE-2026-120474, GHSA-5rm8-gv32-r954 / CVE-2026-116630, GHSA-9v6h-8rgp-m69f / CVE-2026-120415, GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222) - undici >= 7.15.0, < 7.30.2 and >= 8.0.0, < 8.12.4 (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423 SRI whitespace bypass) ## Check whether you're affected Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions: ```sh node -v ``` ## Fix Upgrade to one of these fixed versions (or later on the same branch): - undici 7.30.2 - undici 8.12.4 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Apps are only hit when using an originless Agent with a shared cache and compose(redirect(), cache()). Upgrade undici to 7.30.2 or 8.12.4; clear/invalidate persistent SQLite cache entries written by vulnerable releases where applicable. Never cite cve.now. ## Latest updates - Nov 5, 2026: nodejs/undici publishes coordinated security releases 7.30.2 and 8.12.4 with six GitHub advisories covering cache/redirect cross-user disclosure and poisoning, cross-origin redirect credential stripping bypass, Subresource Integrity whitespace bypass, and cache-interceptor DoS. ## Advisories - [GHSA-mqg3-3v4r-cm32 / CVE-2026-116592: Cache poisoning and cross-user disclosure via intermediate redirect hops](https://github.com/nodejs/undici/security/advisories/GHSA-mqg3-3v4r-cm32) (nodejs/undici) - [GHSA-7xg3-fphp-28hg / CVE-2026-120474: Cross-user cache disclosure via same-origin redirect](https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg) (nodejs/undici) - [GHSA-5rm8-gv32-r954 / CVE-2026-116630: Cross-user information disclosure via cross-origin redirect revalidation](https://github.com/nodejs/undici/security/advisories/GHSA-5rm8-gv32-r954) (nodejs/undici) - [GHSA-9v6h-8rgp-m69f / CVE-2026-120415: Cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping](https://github.com/nodejs/undici/security/advisories/GHSA-9v6h-8rgp-m69f) (nodejs/undici) - [GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222: Denial of Service via unhandled exception in cache-interceptor response replay](https://github.com/nodejs/undici/security/advisories/GHSA-3g9m-rv3r-w5w2) (nodejs/undici) - [GHSA-r4pc-4jcp-7pqc / CVE-2026-120423: Subresource Integrity bypass via whitespace in integrity metadata](https://github.com/nodejs/undici/security/advisories/GHSA-r4pc-4jcp-7pqc) (nodejs/undici) - [undici v8.12.4 security release](https://github.com/nodejs/undici/releases/tag/v8.12.4) (nodejs/undici) - [undici v7.30.2 security release](https://github.com/nodejs/undici/releases/tag/v7.30.2) (nodejs/undici) --- Machine-readable: https://pwn.watch/i/nodejs-undici-7-30-2-8-12-4-cache-redirect-sri-fixes-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.