Bug 2568222 (CVE-2026-116592)

Summary:	CVE-2026-116592 undici: undici: Cache poisoning via intermediate redirect hops
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, cdrage, cmah, csuconic, dbruscin, dhanak, dkeler, dpaolell, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, gbenhaim, gtanzill, gtully, ibolton, jbuscemi, jchui, jdelft, jhe, jlanda, jmatsuok, jmatthew, jmontleo, jsherman, jtolenti, jupierce, kaycoth, kingland, kshier, ktsao, kvanderr, lball, lchilton, lgarciaa, mbiarnes, mnovotny, mstipich, nboldt, ngough, niyer, oaljalju, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, rexwhite, rgemmell, rgodfrey, rhel-process-autobot, rushinde, sausingh, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, sseago, stcannon, sthirugn, suppawar, tbish, thason, tlavocat, twaugh, veshanka, vlaad, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in undici. When handling HTTP redirects with a shared cache enabled, the client inspects only the final redirect destination and fails to account for intermediate hops. A remote attacker who controls a redirect target can exploit this vulnerability to poison the shared cache, which can lead to unauthorized information disclosure if private responses are stored and served to other users.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-06 14:36:12 UTC

undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.