Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Undici may share authenticated data via cache
published 4 months ago
Summary
If you use Undici's shared cache and forward user credentials, the cache can mistakenly store private responses and then serve them to other users. This can expose one user's data to another, even to unauthenticated visitors. Upgrade Undici to the latest version or turn off shared caching for requests that include credentials.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | node-undici | All versions |
Original advisory text
ECHO-8994-d1aa-91ab
References
Timeline
Published18 Jun 2026
Updated18 Jun 2026
First seen18 Jun 2026
Sources
ECHO-8994-d1aa-91ab · OSV
Track software like this
Free during beta