CVE-2026-13697High· 7.4▾ Twilightundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.5%
Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js:
Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.private directives in the same header (such as public, max-age=60, private, private="hdr") cause an uncaught TypeError in the cache-control parser, terminating the request.Applications using interceptors.cache() in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including Set-Cookie.
Required conditions:
Cache-Control: public, max-age=300, private="";Vary header.Applications using interceptors.cache() against an upstream that returns a Cache-Control header combining unqualified private with qualified private="..." see an uncaught TypeError: output.private.concat is not a function during response handling. The request rejects; depending on the consumer's error handling, the process may exit.
private="" is parsed as { private: [''] }. The shared-cache guard only rejects private === true, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.
For the crash variant, an unqualified private directive sets output.private = true, then a subsequent qualified private="hdr" directive attempts output.private.concat(['hdr']), which throws because boolean has no concat method.
The patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to true and preserves existing true values, closing both vectors.
Upgrade to undici 7.29.0 or 8.9.0. Both releases fix the qualified private directive handling that caused the shared-cache storage and the parser crash.
Until patched, avoid shared interceptors.cache() for user-specific responses, use type: 'private', or disable caching for affected origins.
Disclosure variant reported by @h0rk1p via HackerOne report #3817497.
undici >= 7.0.0, < 7.29.0undici >= 8.0.0, < 8.9.0Upgrade to a patched release:
undici 7.29.0undici 8.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16729Medium· 4.8undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-14643Medium· 5.9undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
CVE-2026-15157Medium· 4.2undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-16728Medium· 4.8undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-84947Low· 3.7undici's dump interceptor reads and discards a response body up to a configurable maximum size
CVE-2026-84933Medium· 6.5undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header