EUVD-2026-50567
GHSA-jr45-8vmc-qm54
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the non-default shared-cache configuration, Authorization forwarding, OWS-padded upstream headers, and same-cache-key timing all being required simultaneously; PR:N because the attacker needs no credentials of their own.
Primary rating from Vendor (openjs).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
8Blast Radius
ecosystem impact- 28 npm packages depend on undici (16 direct, 23 indirect)
Ecosystem-wide dependent count for version 7.0.0.
DescriptionNVD
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.
AnalysisAI
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from a shared cache to subsequent callers, including unauthenticated ones, when the upstream origin sends qualified no-cache or private Cache-Control directives with optional whitespace (OWS) around the = delimiter. Affected deployments are those explicitly running undici 7.0.0-7.28.x or 8.0.0-8.8.x with interceptors.cache() in shared mode while forwarding Authorization headers upstream. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to be simultaneously true: (1) the undici cache interceptor is explicitly instantiated in shared-cache mode via `interceptors.cache()` - this is a non-default, opt-in configuration that must be deliberately enabled by the developer; (2) the application forwards `Authorization` request headers to the upstream origin server; and (3) the upstream origin server sends `private` or `no-cache` Cache-Control directives with optional whitespace around the `=` delimiter, such as `private =" authorization"`, `no-cache= "authorization"`, or `no-cache=authorization `. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) overstates exploitability by rating AC:L - this does not capture the three simultaneous non-default application conditions required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A public proof-of-concept is available as a GitHub Gist (https://gist.github.com/alon710/dbd628dcf4d2ee2986aea22ad7d6f2b4). In a realistic attack, a Node.js API gateway or reverse proxy built on undici with shared-cache mode enabled serves both authenticated and unauthenticated clients. … |
| Remediation | Upgrade to undici 7.29.0 (for 7.x deployments) or 8.9.0 (for 8.x deployments) - these are the vendor-confirmed patched releases per GHSA-jr45-8vmc-qm54 (https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54), with fixes applied in commits 85a240551c9feb8b8a0ecc56c84b2b3015add8a9 and cb105d7c79069150982fa11acada0dd94a60dbbc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments running undici 7.0.0-7.28.x or 8.0.0-8.8.x and confirm which ones use interceptors.cache() in shared mode with Authorization headers forwarded upstream. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions
Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior t
Node.js undici WebSocket client denial-of-service vulnerability allows remote attackers to crash the process by sending
Same weakness CWE-436 – Interpretation Conflict
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today