CVE-2026-85152: undici Auth Bypass Vulnerability

CVE-2026-85152 Overview

CVE-2026-85152 is an origin confusion vulnerability in the undici HTTP client for Node.js. Version 8.10.0 introduced a regression where the cache and request-deduplication interceptors omit the destination origin from their internal cache keys. When the cache or deduplicate interceptor is composed directly onto a Client or Pool, the internal key falls back to an empty origin string. A cacheable or in-flight response from one upstream origin can be returned for a request to a different, trusted origin whenever the method, path, and relevant headers match. This flaw is classified under [CWE-346: Origin Validation Error].

Critical Impact
The reporter demonstrated a full authentication bypass in which a JSON Web Token (JWT) signed with an attacker-controlled key was accepted as belonging to a trusted issuer, and the trusted origin was never contacted.

Affected Products

undici version 8.10.0
undici version 8.10.1
undici version 8.10.2 (fixed release)

Discovery Timeline

2026-09-04 - CVE-2026-85152 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85152

Vulnerability Analysis

The undici library is the default HTTP client used by Node.js fetch. It supports pluggable interceptors, including a cache interceptor and a request-deduplication interceptor. Both interceptors compute an internal key to determine whether a stored or in-flight response can satisfy an incoming request.

Starting in 8.10.0, the key derivation logic no longer incorporates the destination origin when the interceptor is composed directly onto a Client or Pool. Instead, the origin field falls back to an empty string. Requests to distinct origins therefore collide on the same key whenever the HTTP method, path, and relevant headers match.

The practical consequence is cross-origin information disclosure and persistent cache poisoning. An attacker who can cause the application to make a request to an attacker-controlled origin first can pin a response into the cache that will subsequently be returned for requests intended for a trusted origin.

Root Cause

The root cause is missing origin validation in the cache key construction. Client and Pool do not attach the origin to per-request dispatch options in the same way that Agent does. The interceptor code path assumed the origin would be present and did not fall back to the Client or Pool base URL when it was absent.

Attack Vector

An attacker induces the target application to issue a request to an attacker-controlled URL that shares the method, path, and relevant headers of a legitimate request to a trusted origin. The response from the attacker origin populates the cache under a key with an empty origin component. Subsequent requests to the trusted origin match the same key and receive the attacker-supplied response body, headers, and status.

In the reporter's demonstration, the attacker-supplied response contained a JSON Web Key Set that allowed a JWT signed with an attacker-controlled key to validate as issued by the trusted authority. Applications that use an Agent, which carries the origin in its dispatch options, are not affected. See the GitHub Security Advisory GHSA-vp8m-p9jh-q5pm for additional technical detail.

Detection Methods for CVE-2026-85152

Indicators of Compromise

Application logs showing successful authentication or authorization decisions where the corresponding outbound HTTPS request to the trusted issuer or API is absent from network telemetry.
Cached responses whose body content does not match the expected schema or signing key of the declared upstream origin.
JWT validation succeeding against unexpected kid values or signing keys not previously observed for the trusted issuer.

Detection Strategies

Inventory Node.js applications and enumerate installed undici versions using npm ls undici or software composition analysis tooling; flag any release in the range 8.10.0 through 8.10.1.
Perform static analysis to identify code that composes interceptors.cache() or interceptors.dedupe() directly onto a Client or Pool rather than an Agent.
Correlate outbound HTTP request telemetry with application-level authentication events to detect decisions made without a corresponding upstream request.

Monitoring Recommendations

Emit structured logs at every JWT verification event including the resolved iss, kid, and the source of the JSON Web Key Set (JWKS).
Alert on JWKS responses served from cache when the payload hash differs from the last known value for a trusted issuer.
Instrument undici dispatchers to record the resolved origin for each dispatched request and alert on empty-origin dispatches.

How to Mitigate CVE-2026-85152

Immediate Actions Required

Upgrade undici to version 8.10.2 in all Node.js services and container images.
Audit application code for direct composition of cache or deduplication interceptors on Client or Pool instances and refactor to use an Agent where feasible.
Invalidate any persisted undici cache stores that were populated while a vulnerable version was in use.
Rotate any cryptographic trust decisions, including cached JWKS material, that may have been influenced by poisoned responses.

Patch Information

The maintainers released undici8.10.2 to restore origin inclusion in cache and deduplication keys. Refer to the GitHub Security Advisory GHSA-vp8m-p9jh-q5pm and the OpenJSF Security Advisories for the authoritative patch notes.

Workarounds

Replace direct Client or Pool dispatchers with an Agent, which carries the origin in its dispatch options and is not affected by this regression.
Remove the cache and deduplicate interceptors from vulnerable dispatchers until the upgrade is deployed.
Pin the resolved undici transitive dependency to 8.10.2 via package manager overrides where a direct upgrade is not possible.

bash

# Upgrade undici to the patched release
npm install undici@8.10.2

# Verify the resolved version in the dependency tree
npm ls undici

# Pin transitive dependencies via package.json overrides
#   "overrides": { "undici": "8.10.2" }