CVE-2026-85152: undici Cross-Origin Cache Poisoning Vulnerability
Summary
CVE-2026-85152: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors. Affects undici versions >= 8.10.0, < 8.10.2. Fixed in 8.10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undici is a popular HTTP/1.1 client designed for Node.js, known for its high performance and efficient resource management. It provides features such as caching and request deduplication to optimize network interactions. However, a recent vulnerability has been identified that compromises its cache and deduplication mechanisms when used across multiple origins.
Vulnerability Detail
The vulnerability arises when the interceptors.cache() or interceptors.deduplicate() methods are utilized with a dispatcher that does not maintain a single authoritative origin. In such cases, undici constructs cache and deduplication keys without considering the actual destination origin. This flaw allows an attacker controlling the response from one origin to have that response returned for requests made to a different, trusted origin, leading to cross-origin information disclosure and persistent cache poisoning. This issue was introduced in undici versions 8.10.0 and 8.10.1.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.10.2
This is the first release that contains the fix.
npm install undici@8.10.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that you use a separate cache store and a distinct interceptor instance for each origin, avoiding sharing them across different origins. This can be implemented in your code as follows:
const { Dispatcher, interceptors } = require('undici');
const dispatcher1 = new Dispatcher();
const cache1 = interceptors.cache();
const interceptor1 = interceptors.deduplicate();
const dispatcher2 = new Dispatcher();
const cache2 = interceptors.cache();
const interceptor2 = interceptors.deduplicate();
Conclusion
The undici package has a critical vulnerability (CVE-2026-85152) that can lead to cross-origin cache poisoning. It is essential to upgrade to the patched version 8.10.2 to mitigate this risk. If immediate upgrading is not feasible, consider implementing the provided workarounds to enhance security.
See every vulnerability recorded for undici →
FAQ
CVE-2026-85152 is a vulnerability in the undici package that allows for cross-origin cache poisoning due to improper handling of cache keys.
The vulnerability affects undici versions 8.10.0 and 8.10.1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
If an immediate upgrade is not possible, implement the suggested workaround by using separate cache stores and interceptor instances for each origin.
References
Related vulnerabilities
Recent vulnerabilities recorded for undici.
