undici vulnerable to cross-user cache disclosure via same-origin redirect

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…undici/security/advisories/GHSA-7xg3-fphp-28hg Diğer
• cna.openjsf.org/security-advisories.html Diğer

Kayıt geçmişi

1. 6 Kas 2026 12:57Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-116630undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
• 5,9 CVE-2026-120415undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
• 5,9 CVE-2026-120423undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
• 7,4 CVE-2026-116592undici HTTP istemcisinde yönlendirme zincirinde önbellek zehirlenmesi ve kullanıcılar arası veri sızıntısı
• 5,9 CVE-2026-120222undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
• 6,5 CVE-2026-89101Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure…