The vulnerability exists in the undici HTTP client when the cache interceptor is combined with downstream handlers that throw during response processing. When a cached response is replayed, an asynchronous exception caused by handlers such as the dump interceptor (exceeding maxSize) or the decompress interceptor (rejecting more than five Content-Encoding values) is not properly caught, leading to an uncaught exception or unhandled promise rejection that terminates the Node.js process. The impact is limited to availability; there is no effect on confidentiality or integrity.

Affected users are those running undici versions 7.0.0 through 7.30.1 or 8.0.0 through 8.12.3 in any Node.js application. The issue is resolved in undici 7.30.2 and 8.12.4 and later. Systems that include undici in their dependencies and use the cache interceptor with handlers that may throw should be considered vulnerable.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is not available, so an exact probability of exploitation is unknown, but the vulnerability can be leveraged remotely by a malicious or compromised HTTP server that serves a cacheable response engineered to trigger the throw on replay. Since it is not listed in CISA KEV, it has not yet been observed in large-scale exploitation. Nonetheless, any application that relies on the vulnerable undici version and communicates with untrusted or potentially malicious servers is at risk of a denial of service event.