Description
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, which permits cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. This is a regression introduced in 8.10.0 and affects undici versions from 8.10.0 up to 8.10.2. Applications using an Agent, which carries the origin in its dispatch options, are not affected. Users should upgrade to undici 8.10.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | 8.10.0 – < 8.10.2 | 8.10.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.10.2+dfsg+~cs3.2.2-1 | — |
| Debian 13 | node-undici | No fix yet | — |
| Debian 12 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs24 +4 | 1:24.21.0-1.el10_2 | RHSA-2026:73428 |
| RHEL 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 | RHSA-2026:73428 |
| RHEL 9 | nodejs +4 | 1:24.21.0-1.module+el9.8.0+24924+cd677006 | RHSA-2026:73838 |
| RHEL 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+24708+e71d2e1d | RHSA-2026:73838 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24708+e71d2e1d | RHSA-2026:73838 |
| RHEL 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+24924+cd677006 | RHSA-2026:73838 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+24924+cd677006 | RHSA-2026:73838 |
| RHEL 8 | nodejs +4 | 1:24.21.0-1.module+el8.10.0+24927+ed3d907a | RHSA-2026:74085 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24711+b610b202 | RHSA-2026:74085 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24711+b610b202 | RHSA-2026:74085 |
| RHEL 8 | npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+24927+ed3d907a | RHSA-2026:74085 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+24927+ed3d907a | RHSA-2026:74085 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.9-0.6.hum1 | RHSA-2026:63782 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.18.1-0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.16.0-1.24.18.1.0.2.2.hum1 | RHSA-2026:54438 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.7.0-1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.19.0-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs24 +4 | 1:24.21.0-1.el10_2 | ALSA-2026:73428 |
| AlmaLinux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.el10_2 | ALSA-2026:73428 |
| AlmaLinux 9 | nodejs +4 | 1:24.21.0-1.module_el9.8.0+321+1555b6a2 | ALSA-2026:73838 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:73838 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:73838 |
| AlmaLinux 9 | npm | 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2 | ALSA-2026:73838 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2 | ALSA-2026:73838 |
| AlmaLinux 8 | nodejs +4 | 1:24.21.0-1.module_el8.10.0+4292+21afb960 | ALSA-2026:74085 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:74085 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:74085 |
| AlmaLinux 8 | npm | 1:11.19.0-1.24.21.0.1.module_el8.10.0+4292+21afb960 | ALSA-2026:74085 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module_el8.10.0+4292+21afb960 | ALSA-2026:74085 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs24 | 1:24.21.0-1.el10_2 | RLSA-2026:73428 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-1.module+el9.8.0+40263+faa47049 | RLSA-2026:97855, RLSA-2026:73838 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:97855, RLSA-2026:73838 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:74085 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:74085 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | pi-coding-agent | 1.0.4-bp160.1.1 | openSUSE-SU-2026:22111-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs24 +4 | 1:24.21.0-1.0.1.el10_2 | ELSA-2026-73428 |
| Oracle Linux 10 | nodejs24-npm | 2:11.19.0-1.24.21.0.1.0.1.el10_2 | ELSA-2026-73428 |
| Oracle Linux 9 | nodejs +4 | 1:24.21.0-1.module+el9.8.0+91053+65d3e6aa | ELSA-2026-73838 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+91009+5d530ccd | ELSA-2026-73838 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-73838 |
| Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa | ELSA-2026-73838 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el9.8.0+91053+65d3e6aa | ELSA-2026-73838 |
| Oracle Linux 8 | nodejs +4 | 1:24.21.0-1.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | npm | 1:11.19.0-1.24.21.0.1.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.module+el8.10.0+91054+4b1a799c | ELSA-2026-74085 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | >= 8.10.0, < 8.10.2 | 8.10.2 | GHSA-vp8m-p9jh-q5pm |
Advisories 19
- WID-SEC-2026-3640 Red Hat Enterprise Linux (undici-nodejs): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:97855 Important: nodejs:26 security update Rocky Linux Security Advisories · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:73838 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:54389 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54438 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74085 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:73838 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:73428 Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63782 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:22111-1 Security update for pi-coding-agent SUSE / openSUSE Security Updates · Oct 19, 2026
- ELSA-2026-74085 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 2, 2026
- RLSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 1, 2026
- RLSA-2026:74085 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 1, 2026
- RLSA-2026:73838 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 30, 2026
- ELSA-2026-73428 Important: nodejs24 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026
- ELSA-2026-73838 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 30, 2026