undici CVE-2026-109829

Exploitable ONLY when all three conditions hold simultaneously in the target application: (1) an originless undici Agent is used, (2) a shared cache store is configured, and (3) the redirect interceptor is composed BEFORE the cache interceptor. Additionally, the attacker must control the target of a redirect originating from a URL the application already trusts. These are non-default, opt-in configuration choices, which is the primary factor limiting real-world exploitation despite the network attack vector and lack of authentication. Exploitation is prevented by the documented workarounds (compose cache before redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests) or by upgrading to undici 7.30.1 / 8.12.2 or later.

This is a genuine but conditionally-exploitable issue rather than a drop-everything priority. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4 HIGH) correctly captures the shape: remotely reachable (AV:N), no authentication needed by the attacker (PR:N), no victim interaction (UI:N), but HIGH attack complexity (AC:H) because exploitation depends on a specific, non-default interceptor composition in the target application. The HIGH confidentiality and integrity impacts are justified - cache poisoning (integrity: serving attacker content under a trusted URL) and private-data disclosure (confidentiality: a user-specific response served to a later unauthenticated caller) are both described. No EPSS score, KEV entry, or POC was provided in the input, so exploitation probability signals are absent. There is no public exploit identified at time of analysis, and undici is NOT in CISA KEV. The signals are internally consistent - there is no network-vs-local or auth conflict to flag. The dominant risk-limiting factor is not the CVSS metrics but the exploitation precondition: the flaw only manifests when an originless Agent, a shared cache store, and the redirect-then-cache interceptor ordering are all present simultaneously, which is an opt-in configuration a minority of undici deployments will have. Treat as a priority patch for applications known to use undici's cache + redirect interceptors with shared caching; routine for everyone else.

An application uses an originless undici Agent that composes the redirect interceptor followed by the cache interceptor over a shared cache store. An unauthenticated attacker who controls the destination of a redirect from a trusted URL causes undici to cache the attacker's cross-origin response under the original trusted key, so subsequent callers requesting the trusted URL are served poisoned content; the same key confusion can also persist a private per-user redirect response and later return it to a different, unauthenticated caller. No public exploit code was identified at time of analysis, and the high attack complexity reflects the required vulnerable interceptor composition.