Node undici: undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed… (CVE-2026-85152)

The undici HTTP client library versions 8.10.0 and 8.10.1 contain a vulnerability (CVE-2026-85152) where the cache and request-deduplication interceptors omit the destination origin from cache keys. This omission leads to missing origin isolation, allowing an attacker who controls responses from one origin to poison the cache entries for another origin. Such poisoning can result in information disclosure and authentication bypass, including scenarios where attacker-signed tokens are accepted as valid. The vulnerability does not impact the default Agent-based dispatch path. The issue is fixed in undici version 8.10.2.

Exploitation of this vulnerability can lead to cross-origin cache poisoning, which may cause information disclosure and authentication bypass. Specifically, an attacker can cause the client to accept maliciously crafted tokens or data from an untrusted origin as if they were from a trusted origin. This undermines the security guarantees of origin isolation in HTTP caching and request deduplication.

A patch addressing this vulnerability is available in undici version 8.10.2. Users should upgrade to version 8.10.2 or later to remediate the issue. The vulnerability does not affect the default Agent-based dispatch path, so using that path may mitigate exposure. No other vendor advisories indicate additional mitigation steps.