Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability exists in the undici HTTP client library for Node.js, which could allow attackers to poison the application's cache or disclose private data. This issue is specific to applications using a particular configuration involving originless agents, shared cache stores, and the redirect-then-cache interceptor order.
- Cache poisoning or data disclosure risks.
- Affects specific Node.js application configurations.
- Confirm relevance and exposure for this library.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by controlling the destination of a redirect from a trusted website. When the vulnerable HTTP client processes this redirect, it incorrectly caches the response from the attacker's controlled site under the trusted site's URL. This allows the attacker to later serve their malicious content to any user who accesses the trusted URL, potentially leading to the disclosure of sensitive data or the delivery of malicious content. This attack is only possible if the application uses a specific configuration combining an originless agent, a shared cache, and a particular order of processing interceptors.
- Requires specific application configuration.
- Triggered by a redirect to attacker-controlled site.
- Risk of cache poisoning and data disclosure.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to poison the cache of an HTTP client, causing it to serve malicious or outdated content to users under specific conditions. When an application uses an originless Agent with a shared cache store and composes redirect and cache interceptors in a particular order, responses to trusted URLs might be stored incorrectly. This could lead to persistent cache poisoning or the disclosure of private user data if a redirect to a user-specific resource is improperly cached and later accessed by an unauthenticated caller.
- Cached responses or private user data.
- When specific interceptor order is used.
- Persistent cache poisoning or data disclosure.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in the undici HTTP client library affects Node.js applications that use a specific combination of originless Agents, shared cache stores, and redirect-then-cache interceptor composition. Application owners or platform teams are likely responsible for assessing and mitigating this risk. The first practical step is to identify all instances of the affected library, determine if the specific vulnerable configuration is in use, confirm exposure, and then plan remediation, which may involve coordinating with vendor teams if the library is part of a third-party integration.
- Identify application owners and scope.
- Verify vulnerable configuration is active.
- Plan remediation or apply workarounds.
