EUVD-2026-50409
GHSA-4cwx-7wf7-3272
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
AC:H because exploitation needs a malformed upstream directive plus a cache-key collision the attacker cannot force; S:C as one user's data crosses to another; C:H (Set-Cookie leak) and A:H (process crash).
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
8Blast Radius
ecosystem impact- 28 npm packages depend on undici (16 direct, 23 indirect)
Ecosystem-wide dependent count for version 7.0.0.
DescriptionNVD
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
AnalysisAI
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions 7.0.0-7.28.x and 8.0.0-8.8.x when the interceptor runs in shared mode (the default). A response bearing a degenerate qualified private directive (e.g. private="") slips past the shared-cache guard and is later served to a different caller sharing the same cache key, leaking private bodies and headers including Set-Cookie; separately, mixing an unqualified and a qualified private directive throws an uncaught TypeError that can crash the process. No public exploit identified at time of analysis, and EPSS is low (0.27%), but the fix is confirmed in undici 7.29.0 and 8.9.0.
Technical ContextAI
undici is the high-performance HTTP/1.1 client that ships bundled inside Node.js and backs the global fetch() API, so the affected code is the caching layer exposed via interceptors.cache(). The root cause (CWE-200, Exposure of Sensitive Information) lives in the Cache-Control parser in lib/util/cache.js. Per RFC 7234, a qualified private directive (private="field-name") restricts only the named header fields, whereas an unqualified private applies to the whole response and must never enter a shared cache. undici's parser stored private="" as { private: [''] } - an array rather than the boolean true - and the shared-cache guard only rejected private === true, so the malformed-but-effectively-unqualified response was cached and reused. The crash variant arises because an unqualified private first sets output.private = true, then a following qualified private="hdr" calls output.private.concat(...), which throws TypeError: output.private.concat is not a function since booleans have no concat method.
RemediationAI
Vendor-released patch: undici 7.29.0 (for the 7.x line) and 8.9.0 (for the 8.x line) - upgrade to whichever matches your major version; both apply the same fix to lib/util/cache.js (commit 4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451, releases https://github.com/nodejs/undici/releases/tag/v7.29.0 and https://github.com/nodejs/undici/releases/tag/v8.9.0). If you cannot upgrade immediately, the vendor's workarounds are: stop using a shared interceptors.cache() for user-specific responses; instantiate the cache interceptor with type: 'private' so responses are not shared across callers (trade-off: loses cross-client cache reuse and its performance benefit); or disable the cache interceptor entirely (trade-off: removes caching and increases origin load). Also review advisory GHSA-4cwx-7wf7-3272 and confirm upstream responses are not emitting malformed Cache-Control directives.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - includ
Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so i
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today