CVE-2026-116630: 
JavaScript vulnerability analysis and mitigation

CVE-2026-116630 is a cross-user information disclosure vulnerability in the Node.js HTTP client library undici, caused by improper cross-origin redirect revalidation in the cache interceptor. When the redirect() and cache() interceptors are composed as compose(redirect(), cache()) with a shared cache, a 304 Not Modified response from a different origin can be used to revalidate a cached response from the original origin, potentially exposing authenticated responses to unauthenticated callers. Affected versions are undici >= 7.0.0, < 7.30.2 and >= 8.0.0, < 8.12.4. It carries a CVSS v3.1 base score of 5.9 (Moderate) (GitHub Advisory).

The root cause is classified under CWE-346 (Origin Validation Error) and CWE-524 (Use of Cache Containing Sensitive Information). When a shared MemoryCacheStore or SqliteCacheStore is used with compose(redirect(), cache()), the redirect handler correctly strips origin-bound credential headers during a cross-origin redirect but fails to strip cache-generated conditional request headers (If-None-Match or If-Modified-Since). As a result, origin B receives origin A's validators, and if B responds with a 304, undici incorrectly treats this as a successful revalidation of A's cached (potentially authenticated) response. The patched versions address this by rejecting any 304 revalidation response whose final origin and path do not match the cache key, and by evicting and refetching the entry if validation checks fail (GitHub Advisory).

Successful exploitation allows an attacker to cause a shared cache to serve a trusted origin's authenticated cached response body to a subsequent, unauthenticated caller — constituting a cross-user information disclosure. The confidentiality impact is rated High, as responses gated by Authorization headers (e.g., user-specific data, tokens, or session content) may be leaked. Integrity and availability are not impacted. The vulnerability is limited to applications using a shared cache with the specific compose(redirect(), cache()) interceptor composition (GitHub Advisory).

Exploitation requires an attacker who can influence a cross-origin redirect from a trusted URL and whose controlled origin can respond to a conditional request with a 304 Not Modified. The attack complexity is rated High (CVSS AC:H), as these preconditions must be met simultaneously. No public proof-of-concept exploit code has been identified, and there is no current evidence of in-the-wild exploitation. The CVE was reserved and the advisory published on November 5, 2026 (GitHub Advisory).

1. Identify a target application using undici with compose(redirect(), cache()) and a shared MemoryCacheStore or SqliteCacheStore.
2. Prime the cache: Cause the target application to fetch and cache an authenticated response from origin A (e.g., a resource requiring an Authorization header), which is stored under origin A's cache key with must-revalidate.
3. Trigger revalidation: Cause the application to revalidate the cached entry for origin A, which sends a conditional request (If-None-Match or If-Modified-Since) to origin A.
4. Influence a cross-origin redirect: Arrange for origin A to redirect the conditional revalidation request to attacker-controlled origin B. The redirect handler strips credential headers but leaves the cache validators intact.
5. Respond with 304: Have origin B respond with 304 Not Modified, causing undici to incorrectly treat this as a successful revalidation of origin A's cached response.
6. Trigger cache serving: As a different (unauthenticated) caller, make a request that hits the same shared cache key — the cache now serves origin A's authenticated response body to this unauthenticated caller (GitHub Advisory).

Upgrade undici to 7.30.2 (for 7.x users) or 8.12.4 (for 8.x users), which reject cross-origin 304 revalidations and evict/refetch cache entries that fail origin validation checks. If an immediate upgrade is not possible, the following workarounds mitigate the issue:

• Reverse the interceptor composition to compose(cache(), redirect()) instead of compose(redirect(), cache()).
• Use per-origin dispatchers and separate cache stores for each origin.
• Disable shared caching on any request path that may involve cross-origin redirects (GitHub Advisory).

The advisory was published by Node.js core maintainer mcollina on November 5, 2026, with credit to security researchers shirabe0x05 and ffasterss for finding the vulnerability, and UlisesGascon as remediation reviewer. The advisory notes that AI assistance was used in preparing the report (GitHub Advisory).