CVE-2026-14643Medium· 5.9▾ Sunlitundici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.3%
Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-= bypass that the earlier fix did not normalize.
Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives whose field-name list is padded with OWS around the =.
Upgrade to undici v7.29.0 or v8.9.0.
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
undici >= 7.0.0, < 7.29.0undici >= 8.0.0, < 8.9.0Upgrade to a patched release:
undici 7.29.0undici 8.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16729Medium· 4.8undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-15157Medium· 4.2undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-13697High· 7.4undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
CVE-2026-16728Medium· 4.8undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-9678Medium· 5.9undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
CVE-2026-84933Medium· 6.5undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header