Listen to this Post
How CVE-2026-13697 Works
Undici is a popular HTTP/1.1 client for Node.js. Its cache interceptor (interceptors.cache()) provides built-in HTTP caching functionality. CVE-2026-13697 affects how this interceptor parses `Cache-Control` headers—specifically the `private` directive—and manifests in two distinct security flaws.
First flaw: Shared-cache disclosure. HTTP defines the `private` directive to indicate that a response is intended for a single user and must not be stored in a shared cache. The undici cache interceptor is designed to enforce this by checking whether the parsed `private` directive equals the boolean true. However, when an upstream server returns a malformed qualified `private` directive with an empty value—such as `Cache-Control: private=””` or private=","—the parser transforms this into { private: [''] }. Because the shared-cache guard only rejects private === true, the array value `[”]` bypasses the check entirely. The response is incorrectly stored in the default shared cache. Later, if another request matches the same cache key—and no `Vary` header separates them—the cached response, containing the original user’s private data (including body and headers like Set-Cookie), is served to the second caller.
Second flaw: Parse-time crash. If a `Cache-Control` header combines an unqualified `private` directive with a qualified one—for example, public, max-age=60, private, private="hdr"—the parser first encounters the unqualified `private` and sets output.private = true. When the parser later processes the qualified private="hdr", it attempts to call output.private.concat(['hdr']). Since `output.private` is a boolean (true), which has no `concat` method, this throws an uncaught TypeError. The request rejects; depending on the application’s error handling, this can terminate the entire Node.js process.
The patch routes qualified-directive parsing through a shared helper that normalizes empty-after-trim arrays to `true` and preserves existing `true` values, closing both vulnerability vectors. Both issues are fixed in undici versions 7.29.0 and 8.9.0.
DailyCVE Form:
Platform: Node.js / npm
Version: 7.0.0-7.28.9, 8.0.0-8.8.9
Vulnerability: Cache poisoning, information disclosure, DoS
Severity: High
date: 2026-07-29
Prediction: 2026-08-15
What Undercode Say:
Analytics
Check current undici version npm list undici Identify vulnerable versions npm list undici | grep -E "7.[0-9]+.[0-9]+|8.[0-8].[0-9]+" Upgrade to patched version npm install [email protected] or npm install [email protected]
Vulnerable code path (`lib/util/cache.js`):
// Before patch: private="" parsed as { private: [''] }
// Guard only checks private === true
if (cacheControl.private === true) {
// reject shared cache
}
// [''] bypasses → response stored in shared cache
// Crash variant:
// unqualified private → output.private = true
// qualified private="hdr" → output.private.concat(['hdr']) → TypeError
PoC request to trigger disclosure:
GET /user-data HTTP/1.1
Host: vulnerable-api.example.com
HTTP/1.1 200 OK
Cache-Control: public, max-age=300, private=""
Set-Cookie: session=eyJ1c2VyIjoiYWxpY2UifQ==
Content-Type: application/json
{"user":"alice","balance":10000}
PoC to trigger crash:
GET /crash HTTP/1.1 Host: vulnerable-api.example.com HTTP/1.1 200 OK Cache-Control: public, max-age=60, private, private="hdr" Content-Type: text/plain This will crash undici
Exploit:
An attacker can exploit CVE-2026-13697 in two ways:
- Information Disclosure: By serving a response with a malformed `Cache-Control: private=””` header from an upstream server they control (or via a man-in-the-middle position), the attacker can cause a user-specific response to be stored in the shared cache. A subsequent request from a different user with the same cache key will receive the first user’s private data, including `Set-Cookie` headers and response bodies. This is particularly dangerous in multi-tenant applications or those that forward `Authorization` headers upstream.
- Denial of Service: By returning a `Cache-Control` header that combines unqualified and qualified `private` directives (e.g.,
private, private="hdr"), an attacker—or a misconfigured upstream server—can trigger an uncaught `TypeError` in the undici cache-control parser. The request rejects; if the application lacks proper error handling around undici requests, the Node.js process may exit entirely, causing a denial-of-service condition.
Both attack vectors affect applications using the default cache interceptor configuration (shared mode), making them widely exploitable.
Protection:
Immediate remediation:
- Upgrade undici to version 7.29.0 or 8.9.0 immediately
npm install [email protected] or for v7 branch npm install [email protected]
Workarounds (if upgrade is not immediately possible) :
- Avoid using `interceptors.cache()` in shared mode for user-specific responses
- Configure the cache interceptor with `type: ‘private’` to restrict caching
- Disable caching entirely for untrusted or user-specific origins
- For traffic that includes `Authorization` headers, disable shared-cache mode or add `Vary: Authorization` upstream
Defensive measures:
- Implement robust error handling around undici request promises to catch and recover from potential `TypeError` exceptions during response header parsing
- Monitor for malformed `Cache-Control` headers in upstream responses
- Consider adding an input sanitization layer that validates HTTP headers before they reach the cache interceptor
Impact:
Confidentiality: Private response bodies and headers—including `Set-Cookie` values containing session tokens—can be leaked to unauthorized users sharing the same cache key. This violates user privacy expectations and can lead to session hijacking, account takeover, and regulatory non-compliance.
Availability: The parse-time crash vulnerability can cause application process termination through carefully crafted `Cache-Control` headers, creating a denial-of-service attack surface. A single malformed response from an upstream server can take down the entire Node.js process.
Scope: All applications using undici with the default cache interceptor configuration (shared mode) are vulnerable. With over 112 million monthly downloads, this represents a significant attack surface across the Node.js ecosystem.
Risk summary: An attacker controlling or positioned to influence upstream responses can exfiltrate sensitive user data from shared caches or crash application processes. The combination of information disclosure and denial-of-service vectors elevates this to a high-severity vulnerability requiring immediate patching.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
