Listen to this Post
How CVE-2026-14643 Works
Undici is a high-performance HTTP client for Node.js. Its cache interceptor provides a shared‑cache mode that allows multiple requests with the same cache key to reuse a single stored response, improving latency and reducing upstream load. The interceptor respects standard Cache‑Control directives, including `private` and `no-cache` with qualified field‑names (e.g., `private=”authorization”` or no-cache="authorization"). According to the HTTP specification, these directives instruct caches not to store the response unless the listed header fields are absent from the request, thereby protecting sensitive user data.
The vulnerability arises from the parser’s handling of optional whitespace (OWS) around the equals sign in such qualified directives. The RFC allows whitespace before or after the `=` (e.g., `no-cache =”authorization”` or no-cache= "authorization"). In affected versions of undici (7.0.0 to before 7.29.0, and 8.0.0 to before 8.9.0), the cache‑control parser does not trim this whitespace. When it encounters a directive like `private=” authorization”` (with a leading space inside the quotes) or `no-cache= “authorization”` (with a space after the equals), the parser either:
– drops the directive entirely, treating the response as cacheable, or
– stores the field name with the literal quote characters and spaces intact (e.g., " authorization").
In both cases, the cache decision logic fails to recognize the `private` or `no-cache` qualification. Consequently, the response is stored in the shared cache even though it contains authenticated data tied to a specific user (e.g., an Authorization header or a session cookie).
When a subsequent request arrives – possibly from a different user or even an unauthenticated caller – and resolves to the same cache key (typically the request method, URL, and selected headers), the cached response is served directly from the cache. This cross‑user information disclosure (CWE‑524) allows one user’s private data to be exposed to another, bypassing the intended protection of `private` and `no-cache` directives.
This vulnerability is a bypass of the earlier fix for CVE‑2026‑9678, which normalized whitespace around field names but did not address OWS around the `=` symbol. The issue affects only applications that explicitly enable the cache interceptor in shared mode (interceptors.cache()), forward `Authorization` headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. The fix, released in undici 7.29.0 and 8.9.0, trims whitespace from both the directive value and the field‑name list, restoring correct qualification parsing.
DailyCVE Form:
Platform: Node.js undici
Version: 7.0.0–7.28.x, 8.0.0–8.8.x
Vulnerability: Cache directive whitespace bypass
Severity: Moderate (CVSS 5.9)
Date: 2026‑07‑29
Prediction: Fixed in 7.29.0 / 8.9.0
What Undercode Say: Analytics
Check installed undici version npm list undici Identify vulnerable versions in lockfiles grep -E '"undici":\s"([bash].)' package-lock.json yarn.lock pnpm-lock.yaml Upgrade to patched version npm install [email protected] for v7 users npm install [email protected] for v8 users Verify the fix with a test header node -e "const { parseCacheControl } = require('undici/lib/util'); console.log(parseCacheControl('private=\" authorization\"'));" Expected output: { private: ['authorization'] } (no quotes, no extra spaces)
Code snippet (parser fix diff):
function parseCacheControlHeader (header) {
// ...
+ for (let j = 0; j < headers.length; j++) {
+ headers[bash] = headers[bash].trim()
+ }
if (key in output) {
output[bash] = output[bash].concat(headers)
} else {
// ...
+ const fieldName = value.trim()
if (key in output) {
- output[bash] = output[bash].concat(value)
+ output[bash] = output[bash].concat(fieldName)
} else {
- output[bash] = [bash]
+ output[bash] = [bash]
}
}
}
Exploit:
A remote attacker can trigger the vulnerability by causing the upstream server to return a `Cache-Control` header with OWS around the `=` in a qualified `private` or `no-cache` directive. For example:
Cache-Control: private = "authorization"
or
Cache-Control: no-cache= "x-user-id"
When undici’s cache interceptor (in shared mode) processes such a response, the parser fails to recognise the qualification. The response – containing sensitive data (e.g., user‑specific JSON, session tokens) – is cached. A subsequent request with the same cache key (e.g., GET /profile) from a different user will receive the previously cached response, disclosing the first user’s private information.
Proof‑of‑Concept (PoC) flow:
- Attacker sends a request as User A to an endpoint that returns
Cache-Control: private = "authorization". - Undici caches the response (because the directive is ignored).
- Attacker (or another user) sends an identical request (same URL, method, cache key) but without any `Authorization` header.
- The shared cache returns User A’s response to the unauthenticated caller.
Protection:
- Upgrade undici to v7.29.0 or v8.9.0 (or any later version).
- If immediate upgrade is not possible:
- Disable shared‑cache mode for any traffic that includes `Authorization` headers.
- Avoid caching responses to authenticated requests (e.g., set `Cache-Control: no-store` upstream).
- Add `Vary: Authorization` to upstream responses to prevent cache reuse across different users.
- Normalize Cache‑Control headers at a reverse proxy or CDN layer to strip extra whitespace before they reach undici.
- Audit your dependency tree to ensure no transitive dependency pulls an unpatched undici version.
Impact:
- Confidentiality breach – an attacker can gain access to another user’s authenticated data (e.g., personal profile, tokens, session identifiers) without proper authorization.
- Shared‑cache pollution – incorrect cache entries may be served to multiple users, breaking the isolation expected from `private` and `no-cache` directives.
- Affected environments – any Node.js application using undici’s cache interceptor in shared mode, especially those that forward `Authorization` headers and rely on Cache‑Control for access control.
- CVSS v3.1 Score: 5.9 (Medium) – network‑attack vector, high confidentiality impact, but requires specific conditions (shared cache, qualified directives with OWS).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
