EUVD-2026-50567
GHSA-jr45-8vmc-qm54
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the non-default shared-cache configuration, Authorization forwarding, OWS-padded upstream headers, and same-cache-key timing all being required simultaneously; PR:N because the attacker needs no credentials of their own.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
8Blast Radius
ecosystem impact- 28 npm packages depend on undici (16 direct, 23 indirect)
Ecosystem-wide dependent count for version 7.0.0.
DescriptionNVD
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.
AnalysisAI
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from a shared cache to subsequent callers, including unauthenticated ones, when the upstream origin sends qualified no-cache or private Cache-Control directives with optional whitespace (OWS) around the = delimiter. Affected deployments are those explicitly running undici 7.0.0-7.28.x or 8.0.0-8.8.x with interceptors.cache() in shared mode while forwarding Authorization headers upstream. This is a bypass of the earlier CVE-2026-9678 fix; a public proof-of-concept exists and vendor-released patches are available in undici 7.29.0 and 8.9.0.
Technical ContextAI
undici is the Node.js native HTTP/1.1 client library, maintained under the Node.js project and distributed via npm (CPE: cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:*). The defect is in lib/util/cache.js's parseCacheControlHeader function, classified under CWE-436 (Interpretation Conflict): RFC 7234 permits optional whitespace (OWS) around the = in qualified Cache-Control directives such as private ="authorization" or no-cache= "authorization", but the undici parser did not trim this whitespace. Consequently, the parser either silently drops the entire directive or stores the field name with embedded literal quote and whitespace characters, neither of which matches the normalized field name the cache decision logic subsequently looks for. The result is that the response is written to cache as if it were publicly shareable, when the origin clearly intended to restrict it to specific header fields. The commit diff shows the fix is a targeted .trim() applied both to the overall field-name value and to each individual name in a comma-separated list. This vulnerability is the whitespace-around-equals variant that the prior fix for CVE-2026-9678 (GHSA-pr7r-676h-xcf6) did not normalize.
RemediationAI
Upgrade to undici 7.29.0 (for 7.x deployments) or 8.9.0 (for 8.x deployments) - these are the vendor-confirmed patched releases per GHSA-jr45-8vmc-qm54 (https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54), with fixes applied in commits 85a240551c9feb8b8a0ecc56c84b2b3015add8a9 and cb105d7c79069150982fa11acada0dd94a60dbbc. If an immediate upgrade is not feasible, the GHSA documents three compensating controls: first, disable shared-cache mode for any traffic path that includes Authorization headers - this eliminates the cross-user risk but removes caching benefits for authenticated flows; second, avoid caching responses to authenticated requests entirely - safest option but eliminates all caching utility for authenticated sessions; third, add Vary: Authorization to upstream server responses - this causes the cache to key on the Authorization header value, preventing cross-user cache collisions, but requires upstream server control and will significantly increase cache miss rates and origin load. None of the workarounds address the underlying parser defect; upgrading remains the definitive fix.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - includ
Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so i
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today