undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…undici/security/advisories/GHSA-5rm8-gv32-r954 Diğer
• cna.openjsf.org/security-advisories.html Diğer

Kayıt geçmişi

1. 6 Kas 2026 13:13Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-120415undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
• 5,9 CVE-2026-120423undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
• 7,4 CVE-2026-116592undici HTTP istemcisinde yönlendirme zincirinde önbellek zehirlenmesi ve kullanıcılar arası veri sızıntısı
• 5,9 CVE-2026-120222undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
• 6,5 CVE-2026-120474undici vulnerable to cross-user cache disclosure via same-origin redirect
• 8,0 CVE-2026-123272mcp-go kütüphanesinde protected resource metadata doğrulama hatası (token yanlış kaynağa verilebilir)