{"id":"CVE-2026-14643","aliases":["CLSA-2026-1791466657","CLSA-2026-1792478858","DEBIAN-CVE-2026-14643","EUVD-2026-50567","GHSA-jr45-8vmc-qm54","GHSA-vmh5-mc38-953g","RHSA-2026:48273","RHSA-2026:48537","ROOT-APP-NPM-CVE-2026-14643","UBUNTU-CVE-2026-14643"],"status":"published","title":"undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives","description":"undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00396,"percentile":0.34035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436","CWE-524"],"published":"2026-07-29T21:08:33Z","modified":"2026-11-05T13:28:26Z","fixes":[{"ecosystem":"npm","package":"undici","fixed_in":["7.29.0","8.9.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"undici","fixed_in":["7.28.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-undici","fixed_in":["8.9.0+dfsg+~cs3.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"undici","fixed_in":["7.29.0-aikido.1","7.29.0-aikido.2","7.29.0-aikido.3","7.29.0-aikido.4","7.29.0-aikido.5","7.29.0-aikido.6"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/undici","fixed_in":["7.29.0-root.io.1","7.29.0-root.io.2","7.29.0-root.io.3","7.29.0-root.io.4","7.29.0-root.io.5","7.29.0-root.io.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.28.0-tuxcare.0"},{"fixed":"7.28.0-tuxcare.8"}]}],"versions":["7.28.0","7.28.0-tuxcare.1","7.28.0-tuxcare.2","7.28.0-tuxcare.3","7.28.0-tuxcare.4","7.28.0-tuxcare.5","7.28.0-tuxcare.6","7.28.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.24.4-tuxcare.0"},{"fixed":"7.24.4-tuxcare.2"}]}],"versions":["7.24.4","7.24.4-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"Debian:12","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0+dfsg1+~cs20.10.9.3-1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3","5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4","5.19.1+dfsg1+~cs20.10.9.5-1","5.19.1+dfsg1+~cs20.10.9.5-2","5.22.1+dfsg1+~cs20.10.10.2-1","5.26.3+dfsg1+~cs23.10.12-1","5.26.3+dfsg1+~cs23.10.12-2","5.26.3+dfsg1+~cs23.10.12-3","5.28.0+dfsg1+~cs23.11.12.3-1","5.28.0+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-1","5.28.2+dfsg1+~cs23.11.12.3-2","5.28.2+dfsg1+~cs23.11.12.3-3","5.28.2+dfsg1+~cs23.11.12.3-4","5.28.2+dfsg1+~cs23.11.12.3-5","5.28.2+dfsg1+~cs23.11.12.3-6","5.28.4+dfsg1+~cs23.12.11-1","5.28.4+dfsg1+~cs23.12.11-2","7.1.0+dfsg1+~cs24.12.10-1","7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.2.3+dfsg1+~cs24.12.11-1","7.2.3+dfsg1+~cs24.12.11-2","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.10.2+dfsg+~cs3.2.2-1","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0+dfsg+~cs3.2.0-1"}]}],"versions":["7.15.0+dfsg+~cs3.2.0-1","7.15.0+dfsg+~cs3.2.0-3","7.16.0+dfsg+~cs3.2.0-1","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.24.5+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-1","7.24.6+dfsg+~cs3.2.0-2","7.24.6+dfsg+~cs3.2.0-3","7.3.0+dfsg1+~cs24.12.11-1","7.3.0+dfsg1+~cs24.12.11-2","8.5.0+dfsg+~cs3.2.0-1","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3"]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}]},{"source":"osv","ecosystem":"npm","package":"undici","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.5.1.1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.5.1-1.5.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.1.0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.1-0.1.hum1"}]}],"bundled":15},{"source":"osv","ecosystem":"Root:npm","package":"undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-aikido.1"},{"fixed":"7.29.0-aikido.2"},{"fixed":"7.29.0-aikido.3"},{"fixed":"7.29.0-aikido.4"},{"fixed":"7.29.0-aikido.5"},{"fixed":"7.29.0-aikido.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29.0-root.io.1"},{"fixed":"7.29.0-root.io.2"},{"fixed":"7.29.0-root.io.3"},{"fixed":"7.29.0-root.io.4"},{"fixed":"7.29.0-root.io.5"},{"fixed":"7.29.0-root.io.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.22.1+dfsg1+~cs20.10.10.2-1ubuntu1","5.26.3+dfsg1+~cs23.10.12-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.18.2+dfsg+~cs3.2.0-1build1","7.24.6+dfsg+~cs3.2.0-3","8.5.0+dfsg+~cs3.2.0-2","8.5.0+dfsg+~cs3.2.0-3","8.9.0+dfsg+~cs3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-undici","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.3.0+dfsg1+~cs24.12.11-2","7.16.0+dfsg+~cs3.2.0-2","7.18.2+dfsg+~cs3.2.0-1","7.18.2+dfsg+~cs3.2.0-1build1"]}],"products":[{"vendor":"nodejs","product":"undici"},{"vendor":"undici","product":"undici"}],"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54","tags":["Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Third Party Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14643","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9","tags":["web"]},{"url":"https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v7.29.0","tags":["web"]},{"url":"https://github.com/nodejs/undici/releases/tag/v8.9.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jr45-8vmc-qm54"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14643.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-14643","tags":["advisory"]},{"url":"https://github.com/nodejs/undici","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48273","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58043","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56847","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56850","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58040","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15157","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14643","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16728","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48273.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508485","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14643","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15157","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16728","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508506","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56847","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56850","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58039","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58040","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509171","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58043","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48537","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56846","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58044","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58042","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58041","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58045","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48537.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56846","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58041","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58042","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58044","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58045","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-14643","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-14643","title":"undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives","description":"undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T21:08:33.311Z","modified":"2026-07-30T15:18:09.76Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-436","CWE-524"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-50567","description":"undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T21:08:33Z","modified":"2026-07-30T15:18:09Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:28.463488Z"}],"ghsa":[{"id":"GHSA-jr45-8vmc-qm54","title":"undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives","description":"## Impact\n\nUndici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache =\"authorization\"` (OWS before `=`) or `no-cache= \"authorization\"` (OWS after `=`). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-`=` bypass that the earlier fix did not normalize.\n\nAffected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified `private` or `no-cache` directives whose field-name list is padded with OWS around the `=`.\n\n## Patches\n\nUpgrade to undici v7.29.0 or v8.9.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.","status":"published","published":"2026-08-03T19:32:12Z","modified":"2026-08-03T19:32:13Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-436","CWE-524"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-14643","description":"undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T22:16:52.337Z","modified":"2026-08-04T15:53:30.723Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-436","CWE-524"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-14643","title":"undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives","description":"undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T21:08:33.311Z","modified":"2026-10-28T02:30:39.045283867Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-436","CWE-524"],"updated_at":"2026-11-02T15:44:57.354194Z"},{"id":"DEBIAN-CVE-2026-14643","description":"undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T22:16:52.337Z","modified":"2026-10-01T03:02:49.035519569Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:51.8748Z"},{"id":"GHSA-jr45-8vmc-qm54","title":"undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives","description":"## Impact\n\nUndici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache =\"authorization\"` (OWS before `=`) or `no-cache= \"authorization\"` (OWS after `=`). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-`=` bypass that the earlier fix did not normalize.\n\nAffected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified `private` or `no-cache` directives whose field-name list is padded with OWS around the `=`.\n\n## Patches\n\nUpgrade to undici v7.29.0 or v8.9.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.","status":"published","published":"2026-08-03T19:32:12Z","modified":"2026-09-10T03:51:14.245060345Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-436","CWE-524"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"RHSA-2026:48273","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:10Z","modified":"2026-10-20T10:10:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48537","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:12Z","modified":"2026-10-20T10:10:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-14643","description":"undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.","status":"published","published":"2026-07-29T22:16:00Z","modified":"2026-10-17T12:58:05.516239804Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"CLSA-2026-1791466657","title":"TuxCare security update for undici (1 CVE)","description":"TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.8.","status":"published","published":"2026-10-08T13:37:37Z","modified":"2026-10-15T09:47:58.248539168Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792478858","title":"TuxCare security update for undici (15 CVEs)","description":"TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.","status":"published","published":"2026-10-20T06:47:38Z","modified":"2026-11-05T13:28:26.36826201Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"ROOT-APP-NPM-CVE-2026-14643","title":"CVE-2026-14643 in undici - Patched by Root","description":"Root has patched CVE-2026-14643 in the undici package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T08:32:42Z","modified":"2026-10-30T09:15:36.868601163Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}