Origin validation error in undici - CVE-2026-85152
Published: September 6, 2026
Vulnerability identifier: #VU147174
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85152
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and poison cached responses across origins.
The vulnerability exists due to improper origin validation in the cache and deduplication key generation of interceptors.cache() and interceptors.deduplicate() when sharing interceptor state across more than one origin. A remote attacker can control a response from one origin that is returned for a matching request to a different trusted origin to disclose sensitive information and poison cached responses across origins.
An Agent is not affected because its dispatch options include the request origin.
Affected software
undici
How to mitigate CVE-2026-85152
Install security update from vendor's website.
undici - update to 8.10.2