HTTP Cache Poisoning via Redirect Origin Validation Bypass

undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and use

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

undici is a popular HTTP client for Node.js that handles HTTP requests, redirects, and response caching. This vulnerability affects versions 7.30.1 and 8.12.2 through 8.12.3 when using an originless Agent with both redirect and shared cache interceptors enabled. The flaw allows attackers to exploit a logic gap in redirect validation: the library only inspects the final redirect hop to determine cache storage keys, rather than validating all hops in the redirect chain. An attacker can craft a redirect sequence that bounces through an untrusted origin before returning to a trusted origin, causing the response to be cached under the original request's key. This enables cache poisoning attacks where malicious content becomes associated with legitimate origin requests, affecting any application or service that consumes cached responses from undici. The impact is significant because cached poisoned responses can serve malicious content to multiple users, escalating from information disclosure to potential code execution depending on application context.

Casky's 754 mapped security skills leverage Claude's extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would detect this through skills mapping to CWE-346 (Origin Validation Error) and CWE-524 (Information Exposure Through Cached Data). The platform's detection capabilities would surface findings related to HTTP header manipulation, redirect chain analysis, and cache key construction validation. Security teams would observe patterns indicating attackers performing reconnaissance on redirect behavior, crafting multi-hop redirect chains, and testing cache storage mechanisms—all precursor activities to cache poisoning exploitation. Casky's skills would highlight deviations in expected redirect validation logic, anomalous cache key assignments, and cross-origin response handling, enabling practitioners to identify vulnerable configurations before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116592.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-116592

Casky has 323 skills that investigate the attack patterns behind CVE-2026-116592. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn