Skip to main content

Undici CVE-2026-9678

| EUVDEUVD-2026-37766 MEDIUM
Use of Cache Containing Sensitive Information (CWE-524)
2026-06-17 openjs GHSA-pr7r-676h-xcf6
Canonical Information Disclosure Undici Red Hat Suse
5.9
CVSS 3.1 · Vendor: openjs
Share

Severity by source

Vendor (openjs) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
5.9 MEDIUM

Network-reachable with no auth required for the attacker, but AC:H because three specific non-default deployment conditions must simultaneously align; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Jun 18, 2026 - 17:02 EUVD
Analysis Generated
Jun 17, 2026 - 18:10 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.

In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.

Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.

Patches: Upgrade to undici v7.28.0 or v8.5.0.

Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.

AnalysisAI

Cache information disclosure in Undici's shared-mode cache interceptor allows a prior authenticated user's HTTP response to be served to a subsequent, potentially unauthenticated, caller. Applications using Undici's explicit interceptors.cache() in shared mode that forward Authorization headers to an upstream which returns Cache-Control headers with whitespace-padded qualified directives (e.g., private=" authorization") are affected across all v7 versions prior to 7.28.0 and all v8 versions prior to 8.5.0. No public exploit has been identified at time of analysis; exploitation is bounded by high attack complexity (CVSS AC:H, score 5.9), but when conditions align, the confidentiality impact is complete.

Technical ContextAI

Undici is a Node.js HTTP/1.1 client library maintained under the OpenJS Foundation, widely embedded in Node.js core and ecosystem tooling. The affected component is its cache interceptor, which implements HTTP caching semantics as defined in RFC 9111. RFC 9111 permits qualified Cache-Control directives such as private and no-cache to carry a quoted field-name list (e.g., private="authorization"), instructing downstream caches to treat those header-scoped responses as non-cacheable or private. The root cause, classified as CWE-524 (Use of Cache Containing Sensitive Information), is that Undici's parser preserves whitespace inside the quoted string. Consequently, private=" authorization" (with a leading space) does not match the canonical literal string authorization during internal comparison, causing the response to be incorrectly classified as cacheable and stored in the shared cache. All undici versions are captured under CPE cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:*, indicating no version prior to the patched releases is exempt.

RemediationAI

Upgrade to undici v7.28.0 or v8.5.0, which correct the whitespace-normalization logic in the cache interceptor's qualified directive parser; the advisory is at https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6. If an immediate upgrade is not feasible, three compensating controls are available with distinct trade-offs. First, disable shared-cache mode for any request path that includes Authorization headers - this eliminates the cross-user leakage vector entirely but forfeits all shared caching benefits for authenticated traffic. Second, configure the application to avoid caching responses to authenticated requests at the Undici layer, which has the same effect with narrower scope. Third, add Vary: Authorization on the upstream server, forcing Undici to treat each distinct Authorization value as a separate cache key and preventing cross-user cache collisions; this workaround requires control of the upstream service and may substantially reduce cache hit rates for authenticated endpoints. Upgrade is strongly preferred over any workaround, as all three workarounds carry performance penalties and require accurate operational knowledge of which traffic paths are affected.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-6734 HIGH
8.8 Jun 17

Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
CVE-2026-9675 HIGH
7.5 Jun 17

Denial-of-service in the undici WebSocket client (Node.js HTTP/WebSocket library) version 8.1.0 through versions prior t

Same weakness CWE-524 – Use of Cache Containing Sensitive Information

View all
CVE-2024-45596 MEDIUM POC
6.5
CVE-2026-53943 CRITICAL
9.6
CVE-2025-69581 MEDIUM POC
5.5
CVE-2026-61836 HIGH
8.6
CVE-2022-3292 MEDIUM POC
4.6
CVE-2026-50170 HIGH
8.2
CVE-2026-71316 HIGH
7.5
CVE-2026-65755 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-9678 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy