Undici, an HTTP client for Node.js, has a flaw that allows cross-user cache disclosure when the redirect interceptor and a shared response cache are enabled together. When an authenticated request is redirected to a same‑origin target, the final response is stored under the original request’s cache key, which excludes credentials and lacks a Vary header. As a result, a later anonymous or different authenticated user can receive the first user’s private response body. This vulnerability is a form of information disclosure and is characterized by CWE‑524 and CWE‑639.

Products: undici (undici). Vulnerable versions are 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3. The issue is fixed in undici 7.30.2 and 8.12.4 and later releases.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, so the current exploitation probability cannot be quantified. Undici is not listed in the CISA KEV catalog. The likely attack vector requires an application that uses undici with the redirect interceptor and shared response cache enabled; the attacker must be able to force an authenticated request that triggers a same‑origin redirect and then use the same cache space to retrieve the cached private response. The vulnerability would lead to cross‑user disclosure of sensitive data but does not allow arbitrary code execution, remote access, or denial of service.