{"id":"CVE-2026-9678","title":"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass","summary":"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass","severity":"medium","cvss":5.9,"cwe":["CWE-524"],"vendor":"undici","product":"undici","affected":["undici >= 7.0.0, < 7.28.0","undici >= 8.0.0, < 8.5.0"],"patched":["undici 7.28.0","undici 8.5.0"],"published":"2026-06-18","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pr7r-676h-xcf6","references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/advisories/GHSA-pr7r-676h-xcf6"}],"tags":["ghsa","npm"],"epss":0.00388,"epssPercentile":0.32711,"ingestedAt":"2026-06-19T03:39:00.823Z","ecosystem":"npm","slug":"CVE-2026-9678","body":"## Overview\n\n## Impact\n\nUndici's cache interceptor incorrectly classifies some responses as cacheable when the upstream `Cache-Control` header uses whitespace-padded qualified `private` or `no-cache` field names such as `private=\" authorization\"` or `no-cache=\"\\tauthorization\"`. The parser preserves the surrounding whitespace, so later comparisons against the literal `authorization` field name fail and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.\n\nAffected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with non-canonical qualified `private` or `no-cache` directives.\n\n## Patches\n\nUpgrade to undici v7.28.0 or v8.5.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.\n\n## Affected packages\n\n- `undici >= 7.0.0, < 7.28.0`\n- `undici >= 8.0.0, < 8.5.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `undici 7.28.0`\n- `undici 8.5.0`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}