Undici

Security incidents tagged Undici. Newest first.

1 Undici incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Patched
undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS
nodejs/undici shipped coordinated security releases 7.30.2 and 8.12.4 on Nov 5 2026 fixing six advisories. High GHSA-mqg3-3v4r-cm32 / CVE-2026-116592 lets an originless Agent with compose(redirect(), cache()) and a shared cache poison or disclose across users because only the final redirect hop was checked, so intermediate hops could bypass the earlier CVE-2026-109829 fix (affected >=7.30.1 <7.30.2 and >=8.12.2 <8.12.4). Five Medium issues in the same release cover same-origin redirect cache disclosure (GHSA-7xg3-fphp-28hg / CVE-2026-120474), cross-origin redirect revalidation disclosure (GHSA-5rm8-gv32-r954 / CVE-2026-116630), array-of-tuples headers bypassing redirect credential stripping (GHSA-9v6h-8rgp-m69f / CVE-2026-120415), unhandled exception DoS during cache-interceptor response replay (GHSA-3g9m-rv3r-w5w2 / CVE-2026-120222), and Subresource Integrity bypass when integrity metadata uses non-space ASCII whitespace such as a tab (GHSA-r4pc-4jcp-7pqc / CVE-2026-120423). Upgrade to undici 7.30.2 or 8.12.4.
undici (Node.js)Since Nov 5, 2026updated Nov 6, 2026, 10:48 UTC

undici 7.30.2 / 8.12.4 fix cache/redirect cross-user disclosure, SRI bypass, and cache DoS
Ulises Gascón
@kom_256
🚨 undici shipped a coordinated security release fixing 6 CVEs (1 high, 5 medium) across 7.x and 8.x: cache/redirect cross-user disclosure and poisoning, a Subresource Integrity bypass, and a denial of service. Upgrade to 7.30.2 or 8.12.4. github.com/nodejs/undici/releases/tag/v8…
Nov 6, 2026view on x