{"id":"CVE-2026-13697","aliases":["CLSA-2026-1790542520","CLSA-2026-1792451423","DEBIAN-CVE-2026-13697","EUVD-2026-50409","GHSA-4cwx-7wf7-3272","RHSA-2026:48273","RHSA-2026:48537","ROOT-APP-NPM-CVE-2026-13697","UBUNTU-CVE-2026-13697"],"status":"published","title":"undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives","description":"undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00569,"percentile":0.47421,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-248","CWE-525"],"published":"2026-07-29T16:32:39Z","modified":"2026-11-05T11:15:10Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["7.29.0","8.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"undici","fixed_in":["7.28.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["8.9.0+dfsg+~cs3.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["7.24.6-aikido.4","7.28.0-aikido.1","8.5.0-aikido.1","7.24.5-aikido.4","7.25.0-aikido.4","7.28.0-aikido.2","7.24.6-aikido.5","7.24.6-aikido.6","7.28.0-aikido.3","7.25.0-aikido.5","7.25.0-aikido.6","7.25.0-aikido.7","7.28.0-aikido.4","7.24.6-aikido.7","7.28.0-aikido.5","7.28.0-aikido.6","7.29.0-aikido.1","7.29.0-aikido.2","7.29.0-aikido.3","7.29.0-aikido.4","7.29.0-aikido.5","7.29.0-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["7.24.6-root.io.4","7.28.0-root.io.1","8.5.0-root.io.1","7.24.5-root.io.4","7.25.0-root.io.4","7.28.0-root.io.2","7.24.6-root.io.5","7.24.6-root.io.6","7.28.0-root.io.3","7.25.0-root.io.5","7.25.0-root.io.6","7.25.0-root.io.7","7.28.0-root.io.4","7.24.6-root.io.7","7.28.0-root.io.5","7.28.0-root.io.6","7.29.0-root.io.1","7.29.0-root.io.2","7.29.0-root.io.3","7.29.0-root.io.4","7.29.0-root.io.5","7.29.0-root.io.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.28.0-tuxcare.0"},{"fixed":"7.28.0-tuxcare.1"}]}],"versions":["7.28.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.4-tuxcare.0"},{"fixed":"7.24.4-tuxcare.1"}]}],"versions":["7.24.4"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0+dfsg+~cs3.2.0-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.5.1.1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.1.0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.24.6-aikido.4"},{"fixed":"7.28.0-aikido.1"},{"fixed":"8.5.0-aikido.1"},{"fixed":"7.24.5-aikido.4"},{"fixed":"7.25.0-aikido.4"},{"fixed":"7.28.0-aikido.2"},{"fixed":"7.24.6-aikido.5"},{"fixed":"7.24.6-aikido.6"},{"fixed":"7.28.0-aikido.3"},{"fixed":"7.25.0-aikido.5"},{"fixed":"7.25.0-aikido.6"},{"fixed":"7.25.0-aikido.7"},{"fixed":"7.28.0-aikido.4"},{"fixed":"7.24.6-aikido.7"},{"fixed":"7.28.0-aikido.5"},{"fixed":"7.28.0-aikido.6"},{"fixed":"7.29.0-aikido.1"},{"fixed":"7.29.0-aikido.2"},{"fixed":"7.29.0-aikido.3"},{"fixed":"7.29.0-aikido.4"},{"fixed":"7.29.0-aikido.5"},{"fixed":"7.29.0-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.24.6-root.io.4"},{"fixed":"7.28.0-root.io.1"},{"fixed":"8.5.0-root.io.1"},{"fixed":"7.24.5-root.io.4"},{"fixed":"7.25.0-root.io.4"},{"fixed":"7.28.0-root.io.2"},{"fixed":"7.24.6-root.io.5"},{"fixed":"7.24.6-root.io.6"},{"fixed":"7.28.0-root.io.3"},{"fixed":"7.25.0-root.io.5"},{"fixed":"7.25.0-root.io.6"},{"fixed":"7.25.0-root.io.7"},{"fixed":"7.28.0-root.io.4"},{"fixed":"7.24.6-root.io.7"},{"fixed":"7.28.0-root.io.5"},{"fixed":"7.28.0-root.io.6"},{"fixed":"7.29.0-root.io.1"},{"fixed":"7.29.0-root.io.2"},{"fixed":"7.29.0-root.io.3"},{"fixed":"7.29.0-root.io.4"},{"fixed":"7.29.0-root.io.5"},{"fixed":"7.29.0-root.io.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272","tags":["Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v7.29.0","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v8.9.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4cwx-7wf7-3272"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13697.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-13697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48273","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58043","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56847","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56850","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58040","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15157","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14643","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16728","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48273.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13697","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14643","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15157","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16728","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508506","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56847","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56850","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58039","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58040","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509171","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58043","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48537","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56846","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58044","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58042","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58041","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48537.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56846","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58041","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58042","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58044","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58045","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-13697","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-13697","title":"undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives","description":"undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T16:32:39.519Z","modified":"2026-07-29T17:53:57.335Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-200","CWE-248","CWE-525"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-50409","description":"undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T16:32:39Z","modified":"2026-07-29T17:53:57Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:29.807737Z"}],"ghsa":[{"id":"GHSA-4cwx-7wf7-3272","title":"undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives","description":"### Summary\n\nTwo issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`:\n\n1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=\"\"` or `private=\",\"` can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.\n2. **Parse-time crash:** Mixed unqualified-and-qualified `private` directives in the same header (such as `public, max-age=60, private, private=\"hdr\"`) cause an uncaught `TypeError` in the cache-control parser, terminating the request.\n\n### Impact\n\n#### Shared-cache disclosure\n\nApplications using `interceptors.cache()` in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including `Set-Cookie`.\n\nRequired conditions:\n\n- the cache interceptor is enabled in shared mode, including the default configuration;\n- an upstream returns a malformed directive such as `Cache-Control: public, max-age=300, private=\"\"`;\n- another request later matches the same cache key, without a separating `Vary` header.\n\n#### Parse-time crash\n\nApplications using `interceptors.cache()` against an upstream that returns a `Cache-Control` header combining unqualified `private` with qualified `private=\"...\"` see an uncaught `TypeError: output.private.concat is not a function` during response handling. The request rejects; depending on the consumer's error handling, the process may exit.\n\n### Details\n\n`private=\"\"` is parsed as `{ private: [''] }`. The shared-cache guard only rejects `private === true`, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.\n\nFor the crash variant, an unqualified `private` directive sets `output.private = true`, then a subsequent qualified `private=\"hdr\"` directive attempts `output.private.concat(['hdr'])`, which throws because boolean has no `concat` method.\n\nThe patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to `true` and preserves existing `true` values, closing both vectors.\n\n### Patches\n\nUpgrade to `undici` 7.29.0 or 8.9.0. Both releases fix the qualified `private` directive handling that caused the shared-cache storage and the parser crash.\n\n### Workarounds\n\nUntil patched, avoid shared `interceptors.cache()` for user-specific responses, use `type: 'private'`, or disable caching for affected origins.\n\n### Credit\n\nDisclosure variant reported by @h0rk1p via HackerOne report [#3817497](https://hackerone.com/reports/3817497).","status":"published","published":"2026-08-03T19:19:47Z","modified":"2026-08-03T19:24:25Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-200","CWE-248","CWE-525"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-13697","description":"undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T17:16:50.503Z","modified":"2026-08-04T14:17:59.003Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-200","CWE-248","CWE-525"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-13697","title":"undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives","description":"undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T16:32:39.519Z","modified":"2026-10-28T02:31:03.186663817Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-200","CWE-248","CWE-525"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-13697","description":"undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T17:16:50.503Z","modified":"2026-10-01T03:02:13.122988203Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:51.374409Z"},{"id":"GHSA-4cwx-7wf7-3272","title":"undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives","description":"### Summary\n\nTwo issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`:\n\n1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=\"\"` or `private=\",\"` can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.\n2. **Parse-time crash:** Mixed unqualified-and-qualified `private` directives in the same header (such as `public, max-age=60, private, private=\"hdr\"`) cause an uncaught `TypeError` in the cache-control parser, terminating the request.\n\n### Impact\n\n#### Shared-cache disclosure\n\nApplications using `interceptors.cache()` in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including `Set-Cookie`.\n\nRequired conditions:\n\n- the cache interceptor is enabled in shared mode, including the default configuration;\n- an upstream returns a malformed directive such as `Cache-Control: public, max-age=300, private=\"\"`;\n- another request later matches the same cache key, without a separating `Vary` header.\n\n#### Parse-time crash\n\nApplications using `interceptors.cache()` against an upstream that returns a `Cache-Control` header combining unqualified `private` with qualified `private=\"...\"` see an uncaught `TypeError: output.private.concat is not a function` during response handling. The request rejects; depending on the consumer's error handling, the process may exit.\n\n### Details\n\n`private=\"\"` is parsed as `{ private: [''] }`. The shared-cache guard only rejects `private === true`, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.\n\nFor the crash variant, an unqualified `private` directive sets `output.private = true`, then a subsequent qualified `private=\"hdr\"` directive attempts `output.private.concat(['hdr'])`, which throws because boolean has no `concat` method.\n\nThe patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to `true` and preserves existing `true` values, closing both vectors.\n\n### Patches\n\nUpgrade to `undici` 7.29.0 or 8.9.0. Both releases fix the qualified `private` directive handling that caused the shared-cache storage and the parser crash.\n\n### Workarounds\n\nUntil patched, avoid shared `interceptors.cache()` for user-specific responses, use `type: 'private'`, or disable caching for affected origins.\n\n### Credit\n\nDisclosure variant reported by @h0rk1p via HackerOne report [#3817497](https://hackerone.com/reports/3817497).","status":"published","published":"2026-08-03T19:19:47Z","modified":"2026-09-10T03:51:13.021707572Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-200","CWE-248","CWE-525"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"RHSA-2026:48273","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:10Z","modified":"2026-10-20T10:10:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48537","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:12Z","modified":"2026-10-20T10:10:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-13697","description":"undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T17:16:00Z","modified":"2026-10-17T12:58:45.534890922Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"CLSA-2026-1790542520","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.1.","status":"published","published":"2026-09-27T20:55:20Z","modified":"2026-10-15T09:47:40.879129694Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792451423","title":"TuxCare security update for undici (5 CVEs)","description":"TuxCare rebuilt undici to address 5 CVEs. Fixed in 7.24.4-tuxcare.1.","status":"published","published":"2026-10-19T23:10:23Z","modified":"2026-10-20T01:45:10.047350061Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"ROOT-APP-NPM-CVE-2026-13697","title":"CVE-2026-13697 in undici - Patched by Root","description":"Root has patched CVE-2026-13697 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-05T10:47:57Z","modified":"2026-11-05T11:15:10.328093681Z","updated_at":"2026-11-05T13:30:49.23793Z"}]}}