undici’s redirect logic mistakenly caches a response under a trusted origin after a redirect chain passes through an untrusted origin. The cache lookup key is computed from only the final hop, so cache entries from a maliciously controlled redirect can be played back to a different user. This allows an attacker to poison the cache for a legitimate URL and cause private, per‑user responses to be served to others, enabling data disclosure. The flaw does not provide remote code execution but can lead to elevated privilege exposure if the cached content contains authenticated data.

The vulnerability affects undici HTTP client versions 7.30.1 and 8.12.2 through 8.12.3 used in Node.js applications. Users running these specific releases are exposed, while later releases are not.

The CVSS score of 7.4 indicates high severity. EPSS data is not available, and the flaw is not currently listed in CISA’s KEV catalog. An attacker who can control the target of a redirect from a trusted origin can trigger the cache poisoning. The attack requires the application to accept untrusted redirect destinations; it does not rely on additional privileged conditions.