{"affected":[{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"undici","product":"undici","source":"CNA: openjs","vendor":"undici","versions":[{"lessThan":"7.30.2","status":"affected","version":"7.0.0","versionType":"semver"},{"status":"unaffected","version":"7.30.2","versionType":"semver"},{"lessThan":"8.12.4","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"unaffected","version":"8.12.4","versionType":"semver"}]}],"cveId":"CVE-2026-120474","cwes":["CWE-524","CWE-639"],"description":"undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: openjs","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"}],"modifiedAt":1793959066664,"publishedAt":1793959066664,"references":[{"source":"CNA: openjs","tags":[],"url":"https://github.com/nodejs/undici/security/advisories/GHSA-7xg3-fphp-28hg"},{"source":"CNA: openjs","tags":[],"url":"https://cna.openjsf.org/security-advisories.html"}],"remediation":[],"revision":"d8bf465fe62b91c34ccb8631eaffd6844b56817e2fa69579f9765c10bb786447","sources":[{"modifiedAt":1793959066664,"name":"CNA: openjs","retrievedAt":1793959707594,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120474"}],"ssvc":null,"status":"published","title":"undici vulnerable to cross-user cache disclosure via same-origin redirect","updatedAt":1793959707594}