Node.js Undici flaw enables cache poisoning and cross-user data leaks

CVE-2026-109829 (CVSS 7.4) in the Undici HTTP client stores cross-origin responses under the initial request's cache key when compose(redirect(), cache()) is used with a shared cache. Versions 7.0.0–7.30.0 and 8.0.0–8.12.1 are affected; fixes ship in 7.30.1 and 8.12.2.

• CVSS 7.4, CWE-346 and CWE-524, PoC available
• Affects Undici 7.0.0–7.30.0 and 8.0.0–8.12.1
• Fixed in 7.30.1 and 8.12.2
• Workaround: compose(cache(), redirect()) or private cache