CVE-2026-13697
published 2026-07-29CVE-2026-13697: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response…
PriorityP353critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.46%
38.8th percentile
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| nodejs | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
| undici | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| undici | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| undici | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
| undici | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
vendor_redhat·2026-07-29·CVSS 9.1
CVE-2026-13697 [CRITICAL] CWE-524 undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issue
GHSA
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
ghsa·2026-08-03
CVE-2026-13697 [HIGH] CWE-200 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
### Summary
Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`:
1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=""` or `private=","` can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.
2. **Parse-time crash:** Mixed unqualified-and-qualified `private` directives in the same header (such as `public, max-age=60, private, private="hdr"`) cause an uncaught `TypeError` in the cache-control parser, terminating the request.
### Impact
#### Shared-cache disclosure
Applications using `interceptors.cache()` in
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-29
Published