CVE-2026-85152

Undici 8.10.0 introduced a regression in which the destination origin is omitted from the internal cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool, causing the empty origin string to be used as a fallback key. As a result, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant headers match, enabling cross-origin information disclosure and persistent cache poisoning. The reporter demonstrated a full authentication bypass in which a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted. Applications on undici 8.10.0 through 8.10.2 that compose these interceptors directly onto a Client or Pool are affected, while applications using an Agent, which carries the origin in its dispatch options, are not affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days, so no active exploitation is known at this time.

What to do: Upgrade to undici 8.10.2, which restores the origin in cache and deduplication keys. As an interim mitigation, stop composing the cache or deduplicate interceptor directly onto Client or Pool instances or dispatch through an Agent instead, and audit existing caches for entries written without origin (clearing them to remove persistent poison). Review whether responses originating from attacker-reachable origins may have been served to trusted origins, particularly around JWT/token validation, and check dependency locks for pinned undici 8.10.0-8.10.1 versions.