CVE-2026-120474

    Dashboard / Vulnerabilities / CVE-2026-120474

    CVE-2026-120474

    Published: 6 Nov 2026Last Modified: 8 Nov 2026

    Summary: undici vulnerable to cross-user cache disclosure via same-origin redirect

    Details: undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.

    References: https://cna.openjsf.org/security-advisories.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120474.json, https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg, https://nvd.nist.gov/vuln/detail/CVE-2026-120474

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 1cfe0949053aac6267f11b919cee9315a27f1fd6
    Fixed -6be57203986b3e7256b726fd14cd1e9527d1a85c

    Affected versions

    v8.12.3
    v8.12.2
    v8.12.1
    v8.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120474 | CVE-DB