Search: CVE-2026-109829

undici versions 7.0.0 through before 7.30.1 and 8.0.0 through before 8.12.2 have a cache poisoning and cross-user data disclosure vulnerability when using an originless Agent with composed redirect and shared cache interceptors. The cache key is built from the original request URL before redirects change the origin, causing responses from redirected origins to be cached under the original URL. This allows an attacker controlling the redirect target to poison the cache or disclose private data to other users. The issue is fixed in versions 7.30.1 and 8.12.2 by verifying origin consistency before caching and preserving cache-control policies across redirects.