undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives (CVE-2026-14643)
Undici versions 7.0.0 through before 7.29.0 and 8.0.0 through before 8.9.0 contain a vulnerability in the cache interceptor where optional whitespace around the equals sign in qualified Cache-Control directives causes improper parsing. This leads to cache decisions that fail to recognize no-cache or private qualifications, allowing authenticated user data to be cached and potentially served to other users. The issue affects applications using shared-cache mode with Authorization headers and cacheable responses containing such directives. Upgrades to versions 7.29.0 or 8.9.0 resolve the issue.
AI Analysis
Technical Summary
The undici HTTP client library's cache interceptor mishandles optional whitespace around the '=' character in qualified 'no-cache' or 'private' Cache-Control directives. This parsing flaw causes the cache logic to either drop the directive or misinterpret the field name, resulting in responses with authenticated user data being cached improperly. In shared-cache mode, this can lead to cross-user information disclosure by serving cached authenticated responses to unauthorized callers sharing the same cache key. The vulnerability affects undici versions >=7.0.0 <7.29.0 and >=8.0.0 <8.9.0. The issue is fixed in versions 7.29.0 and 8.9.0.
Potential Impact
This vulnerability allows an attacker to receive cached responses containing another user's authenticated data if the application uses undici's shared-cache mode with Authorization headers and cacheable responses that include qualified Cache-Control directives with whitespace around '='. This results in cross-user information disclosure without affecting integrity or availability. The CVSS score is 5.9 (medium severity), indicating moderate impact primarily on confidentiality.
Mitigation Recommendations
Upgrade undici to version 7.29.0 or 8.9.0 to apply the official fix. If immediate upgrade is not possible, disable shared-cache mode for requests containing Authorization headers, avoid caching responses to authenticated requests, or ensure upstream responses include a 'Vary: Authorization' header to prevent improper caching.
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives (CVE-2026-14643)
Description
Undici versions 7.0.0 through before 7.29.0 and 8.0.0 through before 8.9.0 contain a vulnerability in the cache interceptor where optional whitespace around the equals sign in qualified Cache-Control directives causes improper parsing. This leads to cache decisions that fail to recognize no-cache or private qualifications, allowing authenticated user data to be cached and potentially served to other users. The issue affects applications using shared-cache mode with Authorization headers and cacheable responses containing such directives. Upgrades to versions 7.29.0 or 8.9.0 resolve the issue.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The undici HTTP client library's cache interceptor mishandles optional whitespace around the '=' character in qualified 'no-cache' or 'private' Cache-Control directives. This parsing flaw causes the cache logic to either drop the directive or misinterpret the field name, resulting in responses with authenticated user data being cached improperly. In shared-cache mode, this can lead to cross-user information disclosure by serving cached authenticated responses to unauthorized callers sharing the same cache key. The vulnerability affects undici versions >=7.0.0 <7.29.0 and >=8.0.0 <8.9.0. The issue is fixed in versions 7.29.0 and 8.9.0.
Potential Impact
This vulnerability allows an attacker to receive cached responses containing another user's authenticated data if the application uses undici's shared-cache mode with Authorization headers and cacheable responses that include qualified Cache-Control directives with whitespace around '='. This results in cross-user information disclosure without affecting integrity or availability. The CVSS score is 5.9 (medium severity), indicating moderate impact primarily on confidentiality.
Mitigation Recommendations
Upgrade undici to version 7.29.0 or 8.9.0 to apply the official fix. If immediate upgrade is not possible, disable shared-cache mode for requests containing Authorization headers, avoid caching responses to authenticated requests, or ensure upstream responses include a 'Vary: Authorization' header to prevent improper caching.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jr45-8vmc-qm54
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-14643"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a710654bf32cb7a343930cd
Added to database: 08/03/2026, 21:21:24 UTC
Last enriched: 08/03/2026, 21:24:54 UTC
Last updated: 08/04/2026, 01:44:00 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.