CVE-2026-18149

In undici, an HTTP client for Node.js, in versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. As a result, a shared cache can serve the original origin's stored authenticated response to a later unauthenticated caller.

In undici for Node.js (versions 7.0.0–7.30.1 and 8.0.0–8.12.3), combining the redirect interceptor with a shared response cache causes an authenticated request redirected to a same-origin target to store the final response under the original request's cache key, which omits credentials and carries no Vary header. A later anonymous or different user can be served the first user's private response body.

In undici for Node.js (versions 7.15.0–7.30.1 and 8.0.0–8.12.3), fetch verifies Subresource Integrity metadata by splitting only on a single space, while the SRI grammar also allows tabs and other ASCII whitespace. An integrity value preceded by a tab is parsed as an unrecognized token and skipped, so undici treats the integrity list as empty and accepts the response, allowing a server to return a body different from the pinned digest.

In undici (HTTP client for Node.js) versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor fails to strip sensitive headers (Authorization, Cookie, Proxy-Authorization, Host) on cross-origin redirects when request headers are supplied as an array of name-value tuples. When combined with a header-normalizing interceptor (cache, deduplicate), origin-bound credentials are disclosed to the unrelated redirect destination.

In undici (HTTP client for Node.js) versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (e.g., dump exceeding maxSize or decompress rejecting more than five Content-Encoding values), an asynchronously raised throw during cached response replay escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process.

In undici for Node.js (versions 7.30.1 and 8.12.2–8.12.3), combining the redirect interceptor with a shared cache allows cache poisoning because the storage decision inspects only the final redirect hop. This can cause a private response to be served to another user or a Vary header and no-cache status to be ignored.

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw. When a downstream handler throws asynchronously from a zlib callback, it escapes as an uncaught exception that terminates the Node.js process. A malicious HTTP server can send a small compressed body that decompresses to more than the configured limit, crashing the client.

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.

The undici library (versions 5.15.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its WebSocket client that allows a malicious server to exhaust process memory by sending PING frames without reading PONG responses, causing unbounded growth of the outbound write queue and heap.

The undici library (versions 6.5.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its EventSource client that allows a malicious server to exhaust process memory by sending millions of tiny completed data fields without a blank event separator, or a single unfinished line split across many chunks, causing unbounded parser state accumulation beyond byte limits.