Vulnerabilities

TI-2026-12340 CVE-2026-14643 · GHSA-jr45-8vmc-qm54

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

LOW 33

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00396 Published 2026-07-29 Partial fix · 7.29.0, 8.9.0 CWE-436

TI-2026-11547 CVE-2026-13697 · GHSA-4cwx-7wf7-3272

MEDIUM 42

undici's cache interceptor mishandles malformed Cache-Control private directives.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00569 Published 2026-07-29 Partial fix · 7.29.0, 8.9.0 CWE-200