CVE-2026-109829

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.

This vulnerability is rated as Important severity because successful exploitation enables remote attackers to achieve shared cache poisoning and unauthorized cross-user data exposure across network boundaries without requiring elevated privileges. Within Red Hat environments shipping Node.js runtimes and associated container services, undici is utilized as an HTTP client backend. However, exploitation requires a specific application architecture where an originless dispatcher chains redirect processing ahead of a shared cache store, rather than the default standalone client configurations. Deployments that do not implement shared caching across multi-origin redirect flows or that isolate cache storage per origin remain unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.