Listen to this Post
How CVE-2026-14643 Works
Undici is a high-performance HTTP/1.1 client for Node.js. It includes a cache interceptor (interceptors.cache()) that can be enabled to cache HTTP responses, optionally in a shared mode where cached responses are shared across multiple requests. To respect origin server caching directives, the interceptor parses the `Cache-Control` header. According to the HTTP specification, optional whitespace (OWS) is permitted around the equals sign (=) of a qualified directive—for example, `no-cache =”authorization”` (OWS before =) or `no-cache= “authorization”` (OWS after =).
In vulnerable versions of Undici (7.0.0 through 7.28.9 and 8.0.0 through 8.8.9), the cache interceptor’s parser mishandles this OWS. When it encounters a qualified `no-cache` or `private` directive with whitespace padding around the =, the parser either drops the directive entirely or stores the field name with literal quote characters included. As a result, the downstream cache decision logic fails to recognize the qualification—it does not see that the directive specifically applies to the `authorization` field.
This parsing failure has a critical consequence in shared-cache mode: a response containing one user’s authenticated data (e.g., a response with an `Authorization` header) is incorrectly classified as cacheable and stored in the shared cache. When a subsequent request—potentially from a different user or even an unauthenticated caller—resolves to the same cache key, the cached response is served. This allows cross-user information disclosure, where one user’s private data is exposed to another.
This vulnerability is a bypass of the earlier fix for CVE-2026-9678 (GHSA-pr7r-676h-xcf6), which addressed whitespace padding inside the quoted field-name list (e.g., private=" authorization") but did not normalize whitespace around the equals sign. Affected applications are those that explicitly enable the cache interceptor in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified `private` or `no-cache` directives padded with OWS around the =.
DailyCVE Form
Platform: Node.js / npm
Version: 7.0.0–7.28.9, 8.0.0–8.8.9
Vulnerability: Cache directive whitespace mishandling
Severity: Moderate (CVSS 4.8)
date: 2026-07-29
Prediction: 2026-07-30 (patch released)
What Undercode Say
The vulnerability stems from inadequate normalization of Cache-Control directive parsing, specifically failing to account for whitespace variations that are legally permitted in HTTP caching standards but not properly handled by the interceptor’s validation logic. The operational impact extends beyond simple cache misbehavior to create serious data leakage scenarios in shared-cache environments. When a response containing authenticated user data is cached under a shared key, the improper parsing allows subsequent requests from different users—including completely unauthenticated ones—to receive cached responses that should remain isolated.
Bash commands to check Undici version:
npm list undici or cat package.json | grep undici
Code snippet showing vulnerable cache interceptor usage:
import { Client, interceptors } from 'undici';
// VULNERABLE: shared cache mode enabled
const client = new Client('https://api.example.com', {
interceptors: {
// This enables the vulnerable cache interceptor
Client: [interceptors.cache()] // shared mode by default
}
});
// Request with Authorization header
const response = await client.request({
path: '/user/profile',
headers: {
'Authorization': 'Bearer user1_token'
}
});
Exploit
An attacker can trigger this vulnerability by causing the upstream server to return a `Cache-Control` header with OWS around the `=` of a qualified directive, such as:
Cache-Control: private ="authorization"
or
Cache-Control: no-cache= "authorization"
When Undici’s cache interceptor processes this header, it fails to recognize the qualification and caches the response. The attacker then makes a second request with the same cache key (e.g., the same URL path) but without valid authentication. The shared cache serves the previously stored authenticated response to the unauthenticated attacker.
Example exploit flow:
- Victim requests `GET /api/orders` with `Authorization: Bearer victim_token`
2. Upstream responds with `Cache-Control: private =”authorization”` and victim’s order data - Undici caches the response (due to parsing failure)
- Attacker requests `GET /api/orders` without any `Authorization` header
- Undici serves victim’s cached order data to the attacker
Protection
Upgrade immediately to Undici v7.29.0 or v8.9.0, which normalize whitespace handling around equals signs in Cache-Control directive parsing.
Workarounds if upgrade is not immediately possible:
- Disable shared-cache mode for traffic that includes `Authorization` headers
- Avoid caching responses to authenticated requests
- Add `Vary: Authorization` upstream to ensure cache differentiation
Audit command to identify vulnerable usage:
grep -r "interceptors.cache()" . --include=".js" --include=".ts"
Impact
Confidentiality: High. In shared-cache mode, this vulnerability allows a response containing one user’s authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller. Private response bodies and headers become accessible to unauthorized parties.
Integrity: Low. The vulnerability does not directly allow modification of data, but cached responses may be served out of context.
Availability: Low. No direct denial-of-service impact from this specific CVE (though related CVE-2026-13697 includes a DoS vector).
Affected Scenarios:
- Applications using `interceptors.cache()` in shared mode (the default)
- Applications forwarding `Authorization` headers upstream
- Applications receiving cacheable responses with qualified `private` or `no-cache` directives padded with OWS around the `=`
CWE Classification: CWE-200 (Information Exposure) and CWE-1236 (Improper Neutralization of Input During Web Page Generation).
Attack Vector: Network-based; requires the attacker to make requests that resolve to the same cache key as a victim’s authenticated request.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
