CVE-2026-13697: undici information disclosure and crash in cache interceptor

CVE-2026-13697 · Severity: high · CVSS 7.4 · Published 2026-07-29

undici is a widely-used HTTP client library for Node.js. Its cache interceptor can incorrectly store user-specific responses in a shared cache when they contain malformed Cache-Control headers, potentially exposing private response bodies, headers, and cookies to other users. Additionally, certain malformed cache directives can crash the cache parser, causing request failures and potentially terminating the application process.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-13697 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13697 being exploited in the wild.
How severe is CVE-2026-13697?
High severity, with a CVSS score of 7.4, published 29 July 2026.
Which products and versions are affected?
undici (npm) SEMVER:introduced=7.0.0,fixed=7.29.0.
Is there a fix for CVE-2026-13697?
Yes. undici (npm): upgrade to 7.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13697 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-13697?
Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • undici (npm): upgrade to 7.29.0 or later
    npm install undici@7.29.0

Technical details

The vulnerability exists in undici's cache-control parser (lib/util/cache.js) and manifests in two distinct but related ways. First, malformed qualified Cache-Control private directives such as private="" or private="," are incorrectly parsed as arrays and bypass the shared-cache guard, which only checks for private === true. This allows user-specific responses to be stored in the default shared cache and served to subsequent callers with matching cache keys, disclosing Set-Cookie headers and response bodies. Second, mixing unqualified private directives (which set output.private = true) with qualified private="fieldname" directives causes a TypeError when the parser attempts to call .concat() on the boolean value. Both issues are fixed by normalizing empty-after-trim field name arrays to true and preserving existing true values. Patches are available in undici versions 7.29.0 and 8.9.0. The vulnerability requires the cache interceptor to be enabled (which is the default configuration for shared mode) and an upstream server returning malformed directives.

Affected products

  • Node.js undici >=7.0.0, <7.29.0; >=8.0.0, <8.9.0

Identifiers

  • CVE-2026-13697
  • GHSA-4cwx-7wf7-3272

Timeline

  • 2026-07-29: disclosed: NVD publication date
  • 2026-08-03: disclosed: GitHub advisory GHSA-4cwx-7wf7-3272 published
  • 2026-07-23: patched: Fix committed (before public disclosure)
  • 2026-06-23: other: Patch authored

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.