Bug 2568183 (CVE-2026-120474)

Summary:	CVE-2026-120474 undici: undici: Information disclosure via shared cache and same-origin redirects
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, cdrage, cmah, csuconic, dbruscin, dhanak, dkeler, dpaolell, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, gbenhaim, gtanzill, gtully, ibolton, jbuscemi, jchui, jdelft, jhe, jlanda, jmatsuok, jmatthew, jmontleo, jsherman, jtolenti, jupierce, kaycoth, kingland, kshier, ktsao, kvanderr, lball, lchilton, lgarciaa, mbiarnes, mnovotny, mstipich, nboldt, ngough, niyer, oaljalju, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, rexwhite, rgemmell, rgodfrey, rhel-process-autobot, rjohnson, rushinde, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, sseago, stcannon, sthirugn, suppawar, tbish, thason, tlavocat, twaugh, veshanka, vlaad, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in undici. When an application combines redirect handling with shared response caching, authenticated requests redirected to a same-origin target store the response under the initial request's cache key without credential restrictions. A subsequent unauthenticated or different user requesting the original resource can be served this cached response, leading to cross-user information disclosure of private data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-06 14:33:39 UTC

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.