Patch Ticker

undici HTTP client leaks cached private responses across users

Another person's private web replies can leak out through a cache.

Summary

undici is an HTTP client for Node.js. When redirects and a shared response cache are used together, one user's private response can be served to another user, and related flaws were fixed in the same releases.

Affected when

  • redirect interceptor and shared response cache used together
  • undici 7.0.0 to 7.30.1 or 8.0.0 to 8.12.3 (range varies by flaw)

What to do

Update to undici 7.30.2 or 8.12.4 or later. If you cannot update yet, place the cache interceptor before the redirect interceptor, or turn off shared caching on redirect requests.

Update to at least the version for your product:

  • undici 7.x 7.30.2 or later
  • undici 8.x 8.12.4 or later

Products and platforms

  • undici

CVE IDs

Sources

Times

First published

First seen