Read the docs
TI-2026-11547 Aliases CVE-2026-13697GHSA-4cwx-7wf7-3272

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Priority MEDIUM 42CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Denial of service
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 5 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-248.

Summary

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00569 47th percentileScored 2026-11-07
Fix Partial undici (undici): 7.29.0, 8.9.0undici (npm): 7.29.0, 8.9.0Red Hat: 7 advisoriesRed Hat: 5 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSundici7.0.0 to before 7.29.0; 8.0.0 to before 8.9.07.29.0, 8.9.0Patch availableCNA
—undici (npm)7.0.0 to before 7.29.07.29.0Patch availableGHSA-4cwx-7wf7-3272
—undici (npm)8.0.0 to before 8.9.08.9.0Patch availableGHSA-4cwx-7wf7-3272
  • undici VendorNodeJS Affected 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 Fixed in 7.29.0, 8.9.0 Patch available CNA
  • undici (npm) Vendor— Affected 7.0.0 to before 7.29.0 Fixed in 7.29.0 Patch available GHSA-4cwx-7wf7-3272
  • undici (npm) Vendor— Affected 8.0.0 to before 8.9.0 Fixed in 8.9.0 Patch available GHSA-4cwx-7wf7-3272

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA undici (undici) Fixed in 7.29.0, 8.9.0
  • Fix · GHSA-4cwx-7wf7-3272 undici (npm) Fixed in 7.29.0 Advisory →
  • Fix · GHSA-4cwx-7wf7-3272 undici (npm) Fixed in 8.9.0 Advisory →

Red Hat 7 advisories

  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:82151 Released 2026-10-13 · Red Hat rating Critical
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
Show 4 more Red Hat advisories
  • RHSA-2026:79088 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:76788 Released 2026-10-06 · Red Hat rating Critical
    Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
  • RHSA-2026:48537 Released 2026-07-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs24-1:24.18.1-0.1.hum1@aarch64, nodejs24-1:24.18.1-0.1.hum1@src, nodejs24-1:24.18.1-0.1.hum1@x86_64 +14
  • RHSA-2026:48273 Released 2026-07-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs26-1:26.5.1-1.5.hum1@aarch64, nodejs26-1:26.5.1-1.5.hum1@src, nodejs26-1:26.5.1-1.5.hum1@x86_64 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    undici 7.29.0, 8.9.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-12340 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesPriority LOW 33
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Secrets Management Console for Red Hat OpenShiftAffectedNo fix yet
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:82151
Red Hat Developer Hub 1.10Fixed RHSA-2026:76788, RHSA-2026:79088
Red Hat Hardened ImagesFixed RHSA-2026:48273, RHSA-2026:48537
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 18 products
  • Cryostat 4
  • Exploit Intelligence
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Podman Desktop
  • Red Hat Developer Hub 1
  • Red Hat Developer Hub 1.10
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat Openshift Data Foundation 4
  • Red Hat Trusted Artifact Signer
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13697
  2. 2026-10-03 Alias added: GHSA-4cwx-7wf7-3272
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-08 Affected versions changed · Red Hat
  6. 2026-10-09 Fix available: RHSA-2026:76788 · Red Hat
  7. 2026-10-09 Fix available: RHSA-2026:79088 · Red Hat
  8. 2026-10-09 Fix available: Red Hat Developer Hub 1.10 · Red Hat
  9. 2026-10-10 Affected versions changed · Red Hat
  10. 2026-10-13 Fix available: Red Hat Ansible Automation Platform 2.2 · Red Hat
  11. 2026-10-13 Fix available: RHSA-2026:82151 · Red Hat
  12. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  13. 2026-10-22 Fix available: Red Hat OpenShift AI 3.5 · Red Hat
  14. 2026-10-27 Affected versions changed · Red Hat
  15. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat

References

Advisory 3

Other 4

  • TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
  • TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
  • TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
  • TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
  • TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
  • TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences