The vulnerability occurs when undici builds redirect and shared cache interceptors in an Agent, allowing a cached 304 Not Modified response obtained from a different origin to be validated as fresh for a stored response with Authorization headers. This leads to the original owner’s authenticated content being served to an unauthenticated user who subsequently makes a request that triggers the redirect. The weakness involves improper handling of cache validators during revalidation (CWE-346) and failure to strip sensitive headers across origins (CWE-524). The result is cross‑user information disclosure, exposing data that the original caller was not permitted to see.

The flaw affects undici versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3. Users running any of these releases on Node.js should consider them vulnerable until the patch is applied.

The CVSS score of 5.9 indicates a moderate severity, and no EPSS data is available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to convince or control a user’s undici client to issue a redirect‑capable request that satisfies the conditional revalidation logic. The likely attack vector is via a malicious origin that redirects a user’s cached request, allowing the attacker to read sensitive data through the aborted 304 validation process. Given the moderate severity score and lack of publicly known exploitation, the risk is medium but should still be mitigated promptly.