Junglewise Threat Intelligence

CVE-2026-13697: undici information disclosure and crash in cache interceptor

CVE-2026-13697 · Severity: high · CVSS 7.4 · Published 2026-07-29

Executive brief

undici is a widely-used HTTP client library for Node.js. Its cache interceptor can incorrectly store user-specific responses in a shared cache when they contain malformed Cache-Control headers, potentially exposing private response bodies, headers, and cookies to other users. Additionally, certain malformed cache directives can crash the cache parser, causing request failures and potentially terminating the application process.

Technical details

The vulnerability exists in undici's cache-control parser (lib/util/cache.js) and manifests in two distinct but related ways. First, malformed qualified Cache-Control private directives such as private="" or private="," are incorrectly parsed as arrays and bypass the shared-cache guard, which only checks for private === true. This allows user-specific responses to be stored in the default shared cache and served to subsequent callers with matching cache keys, disclosing Set-Cookie headers and response bodies. Second, mixing unqualified private directives (which set output.private = true) with qualified private="fieldname" directives causes a TypeError when the parser attempts to call .concat() on the boolean value. Both issues are fixed by normalizing empty-after-trim field name arrays to true and preserving existing true values. Patches are available in undici versions 7.29.0 and 8.9.0. The vulnerability requires the cache interceptor to be enabled (which is the default configuration for shared mode) and an upstream server returning malformed directives.

Affected products

  • Node.js undici >=7.0.0, <7.29.0; >=8.0.0, <8.9.0

Timeline

  • 2026-07-29: disclosed: NVD publication date
  • 2026-08-03: disclosed: GitHub advisory GHSA-4cwx-7wf7-3272 published
  • 2026-07-23: patched: Fix committed (before public disclosure)
  • 2026-06-23: other: Patch authored

References