undici CVE-2026-85152

Exploitation requires that the target application runs undici 8.10.0 or 8.10.1 AND wires either the cache interceptor or the request-deduplication interceptor directly onto a Client or Pool instance (for example, via Client.compose() or Pool.compose() with cacheInterceptor or deduplicateInterceptor). Applications that instantiate an Agent and compose interceptors there are not affected, because the Agent propagates the origin through its dispatch options. The attacker must additionally be able to issue or pre-cache an HTTP response whose method, path, and relevant headers match a request the application will subsequently make to a distinct trusted origin. No attacker authentication or elevated privileges are required, but the specific Client/Pool interceptor-composition pattern must be present in the application.

The CVSS 7.4 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately characterizes the balance of factors: exploitation is remote and requires no attacker credentials, but the high attack complexity reflects a genuine prerequisite - the vulnerable interceptor-composition pattern (Client/Pool, not Agent) must be present in the application code. The confidentiality (C:H) and integrity (I:H) impacts are well-supported by the demonstrated auth-bypass scenario. No EPSS score was provided in the input data, and this CVE does not appear in CISA KEV, indicating no confirmed in-the-wild exploitation at time of analysis. Despite the absence of KEV and public exploit code, the narrow version window (8.10.0-8.10.1), the availability of an exact patch (8.10.2), and the severity of the demonstrated impact mean that even a mid-sized municipal IT team in olsztyn should treat this as urgent if they deploy undici with the affected interceptor pattern. The primary limiting factor on real-world exposure is that applications using an Agent - the more common and documented composition pattern - are fully unaffected, and the vulnerable window spans only two minor releases.

An attacker pre-stages a cacheable HTTP request to an attacker-controlled origin whose method, path, and headers match a request the victim application is known to make to a trusted upstream service. Because undici 8.10.0-8.10.1 caches the response under an empty origin key, the next time the application sends the same request to the trusted service, it receives the attacker's pre-staged response without ever contacting the trusted origin. In the demonstrated scenario, the attacker substitutes a JWT signed with their own key, which the application accepts as valid because the trusted identity provider is bypassed entirely via the poisoned cache entry.