undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors (CVE-2026-85152)

The undici HTTP client library versions 8.10.0 and 8.10.1 contain a vulnerability where the cache and deduplicate interceptors, when composed directly onto a Client or Pool, omit the destination origin from cache and request deduplication keys. This omission allows responses from one origin to be incorrectly served for requests to a different origin if method, path, and relevant headers match. An attacker controlling responses from one origin can exploit this to perform cross-origin cache poisoning, leading to information disclosure and potentially full authentication bypass, such as accepting attacker-controlled JWT tokens as valid for a trusted issuer. The default Agent dispatch path is not affected because it includes the origin in dispatch options. The vulnerability was introduced in version 8.10.0 and fixed in 8.10.2.

An attacker who controls responses from one origin can cause those responses to be returned for requests to a different trusted origin, resulting in cross-origin information disclosure and persistent cache poisoning. This can lead to severe consequences including authentication bypass, where attacker-signed tokens are accepted as valid by the application without contacting the legitimate issuer. The vulnerability affects applications that share cache or deduplicate interceptor state across origins by composing these interceptors directly onto Client or Pool objects. The default Agent-based dispatch path is not vulnerable.

A fix is available in undici version 8.10.2. Users should upgrade to version 8.10.2 or later to remediate this vulnerability. As a workaround, do not share cache stores or interceptor instances across multiple origins; instead, use separate cache stores and interceptor instances per origin. Applications using the default Agent dispatch path are not affected. No other practical mitigations have been identified by the vendor.