CVE-2026-109829: CVE-2026-109829: Persistent Cache Poisoning and Cross-User Information Disclosure in Node.js Undici

Node.js Undici faces two critical vulnerabilities. CVE-2026-109829 involves persistent cache poisoning and cross-user information disclosure due to origin desynchronization in versions 7.0.0-7.30.0 and 8.0.0-8.12.1. Simultaneously, CVE-2026-109383 reveals improper certificate validation within the Agent Dispatcher. This occurs because util.deepClone uses JSON serialization, which silently strips custom tls.checkServerIdentity callbacks. Both vulnerabilities carry a CVSS score of 7.4, compromising the security of the official HTTP/1.1 and HTTP/2 client library for Node.js environments.