Executive brief
Undici, a popular HTTP client for Node.js, contains a flaw in its caching mechanism. When configured in shared-cache mode, it may incorrectly store and serve private, authenticated data to the wrong users. This could allow an unauthorized person to view sensitive information belonging to another user if the server uses specific formatting in its security headers.
Technical details
A vulnerability exists in Undici's cache interceptor (interceptors.cache()) where the parser fails to strip whitespace from qualified 'private' or 'no-cache' field names in the Cache-Control header (e.g., private=" authorization"). Because the parser preserves this whitespace, subsequent checks against literal field names like "authorization" fail, causing the interceptor to cache sensitive authenticated responses. In shared-cache mode, these cached responses can be served to different users, including unauthenticated ones, if the cache keys match. The issue affects versions 7.x and 8.x and is fixed in v7.28.0 and v8.5.0. Exploitation requires the application to have the cache interceptor enabled in shared mode and for the upstream server to send non-canonical headers.
Affected products
- Node.js undici >= 7.0.0, < 7.28.0; >= 8.0.0, < 8.5.0
Timeline
- 2026-06-17: advisory: GitHub Advisory GHSA-pr7r-676h-xcf6 published
- 2026-06-17: disclosed