{"id":"EM-20261106-35ZW","url":"https://cyber.eventmonitor.net/incident/EM-20261106-35ZW/undici-vulnerability-cve-2026-116592/","type":"cve","title":"undici Vulnerability (CVE-2026-116592)","subtitle":"CVE-2026-116592","subject":"CVE-2026-116592","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-06T10:16:36.313Z","firstSignal":"2026-11-06T10:05:41.000Z","lastSignal":"2026-11-06T10:16:36.313Z","updated":"2026-11-09T13:00:37.045Z","revision":1,"life":[{"status":"Born","at":"2026-11-06T10:16:36.313Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-06T10:16:36.313Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-06T10:05:41.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-06T10:16:36.313Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261106-35ZW created."}],"stages":[{"name":"Disclosed","at":"2026-11-06T10:16:36.313Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-06T10:16:36.313Z","detail":"CVSS 7.4 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-06T10:05:41.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-06T10:05:41.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-116592 (important)","text":"undici: undici: Cache poisoning via intermediate redirect hops","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-116592.json"},{"at":"2026-11-06T10:16:36.313Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-116592 (CVSS 7.4)","text":"undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116592"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-06T10:16:36.313","score":7.4,"severity":"HIGH","desc":"undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which…","product":"","seen":1794004813034},"kev":null,"epss":{"epss":0.00157,"pct":0.04853,"at":1794229237045},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}