CVE-2026-85152

This flaw is present in the undici HTTP client library used by Node.js. When an application composes undici's Cache or Deduplicate interceptor directly onto a Client or Pool object (rather than onto an Agent), the library's internal cache and in-flight-request deduplication keys omit the destination origin. As a result, a cached or in-flight response captured for one upstream origin can be returned for a request intended for a different, trusted origin whenever the method, path, and relevant headers match. In the most severe demonstrated scenario, this allowed an attacker-controlled JWT to be accepted by the application as though it had been validated against a legitimate, trusted issuer, without that issuer ever being contacted — resulting in a full authentication bypass. Exploitation requires that the affected application attach the Cache or Deduplicate interceptor directly to a Client/Pool — the default Agent-based dispatch path is not affected, since Agent already carries the origin in its dispatch options — and that an attacker can influence or collide with the cache/deduplication key for at least one origin the application communicates with.).