Read the docs
TI-2026-12340 Aliases CVE-2026-14643GHSA-jr45-8vmc-qm54

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

Priority LOW 33CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Partial undici (undici): 7.29.0, 8.9.0undici (npm): 7.29.0, 8.9.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSundici7.0.0 to before 7.29.0; 8.0.0 to before 8.9.07.29.0, 8.9.0Patch availableCNA
—undici (npm)7.0.0 to before 7.29.07.29.0Patch availableGHSA-jr45-8vmc-qm54
—undici (npm)8.0.0 to before 8.9.08.9.0Patch availableGHSA-jr45-8vmc-qm54
  • undici VendorNodeJS Affected 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 Fixed in 7.29.0, 8.9.0 Patch available CNA
  • undici (npm) Vendor— Affected 7.0.0 to before 7.29.0 Fixed in 7.29.0 Patch available GHSA-jr45-8vmc-qm54
  • undici (npm) Vendor— Affected 8.0.0 to before 8.9.0 Fixed in 8.9.0 Patch available GHSA-jr45-8vmc-qm54

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0VulnerableNodeJS
  • cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA undici (undici) Fixed in 7.29.0, 8.9.0
  • Fix · GHSA-jr45-8vmc-qm54 undici (npm) Fixed in 7.29.0 Advisory →
  • Fix · GHSA-jr45-8vmc-qm54 undici (npm) Fixed in 8.9.0 Advisory →

Red Hat 2 advisories

  • RHSA-2026:48537 Released 2026-07-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs24-1:24.18.1-0.1.hum1@aarch64, nodejs24-1:24.18.1-0.1.hum1@src, nodejs24-1:24.18.1-0.1.hum1@x86_64 +14
  • RHSA-2026:48273 Released 2026-07-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs26-1:26.5.1-1.5.hum1@aarch64, nodejs26-1:26.5.1-1.5.hum1@src, nodejs26-1:26.5.1-1.5.hum1@x86_64 +14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    undici 7.29.0, 8.9.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-11547 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesPriority MEDIUM 42
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat Hardened ImagesFixed RHSA-2026:48273, RHSA-2026:48537
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14643
  2. 2026-10-03 Alias added: GHSA-jr45-8vmc-qm54

References

Advisory 3

Other 5

  • TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
  • TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
  • TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
  • TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
  • TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
  • TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences