# CVE-2026-14643: Node.js undici information disclosure via Cache-Control whitespace bypass

Source: https://junglewise.ai/threats/cve-2026-14643-node-js-undici-information-disclosure-via-cache-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-14643 · Severity: medium · CVSS 5.9 · Published 2026-07-29

Undici, a popular HTTP client for Node.js, contains a flaw in how it handles cached web responses. When configured to share a cache between different users, the library may fail to recognize security instructions that are supposed to keep sensitive data private if those instructions contain extra spaces. This could allow one user's private, authenticated information to be accidentally served to a different, potentially unauthenticated user.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-14643 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14643 being exploited in the wild.

**How severe is CVE-2026-14643?** Medium severity, with a CVSS score of 5.9, published 29 July 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=7.0.0,fixed=7.29.0.

**Is there a fix for CVE-2026-14643?** Yes. undici (npm): upgrade to 7.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14643 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14643?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 7.29.0 or later

  ```sh
  npm install undici@7.29.0
  ```


## Technical details

A vulnerability exists in Undici's cache interceptor due to improper parsing of optional whitespace (OWS) around the equals sign in 'no-cache' or 'private' Cache-Control directives (e.g., 'no-cache =\"authorization\"'). The parser fails to normalize this whitespace, causing it to either drop the directive or store the field name incorrectly. In shared-cache mode, this leads to an interpretation conflict where the cache fails to exclude sensitive headers like 'Authorization' from the stored response. Consequently, an attacker or subsequent user sharing the same cache key can retrieve a cached response containing another user's authenticated data. The issue is patched in versions 7.29.0 and 8.9.0.

## Affected products

- Node.js undici >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0

## Identifiers

- CVE-2026-14643
- GHSA-jr45-8vmc-qm54

## Timeline

- 2026-07-29: patched: Fixes released in v7.29.0 and v8.9.0
- 2026-07-29: disclosed
- 2026-08-03: advisory

## References

- [https://api.github.com/users/rampage0010](https://api.github.com/users/rampage0010)
- [https://github.com/rampage0010](https://github.com/rampage0010)
- [https://api.github.com/users/rampage0010/gists%7B/gist_id%7D](https://api.github.com/users/rampage0010/gists%7B/gist_id%7D)
- [https://api.github.com/users/rampage0010/repos](https://api.github.com/users/rampage0010/repos)
- [https://avatars.githubusercontent.com/u/65641631?v=4](https://avatars.githubusercontent.com/u/65641631?v=4)
- [https://api.github.com/users/rampage0010/events%7B/privacy%7D](https://api.github.com/users/rampage0010/events%7B/privacy%7D)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)