CVE-2026-14643
published 2026-07-29CVE-2026-14643: undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.30%
22.7th percentile
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| nodejs | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
| undici | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| undici | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| undici | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
| undici | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
ghsa5.9MEDIUM
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing
vendor_redhat·2026-07-29·CVSS 7.5
CVE-2026-14643 [HIGH] CWE-524 undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing
undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authoriz
GHSA
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
ghsa·2026-08-03·CVSS 5.9
CVE-2026-14643 [MEDIUM] CWE-436 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
## Impact
Undici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache ="authorization"` (OWS before `=`) or `no-cache= "authorization"` (OWS after `=`). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The i
VulDB
Node.js undici up to 7.28.9/8.8.9 Cache Interceptor improper authorization
vuldb·2026-07-29·CVSS 5.9
CVE-2026-14643 [MEDIUM] Node.js undici up to 7.28.9/8.8.9 Cache Interceptor improper authorization
A vulnerability categorized as problematic has been discovered in Node.js undici up to 7.28.9/8.8.9. This impacts an unknown function of the component Cache Interceptor. The manipulation results in improper authorization.
This vulnerability is cataloged as CVE-2026-14643. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-29
Published