{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/undici-7.x--7.29.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-13697"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["undici (7.x \u003c 7.29.0)","undici (8.x \u003c 8.9.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","npm","nodejs","webserver"],"_cs_type":"advisory","_cs_vendors":["OpenJS Foundation"],"content_html":"\u003cp\u003eThe undici HTTP/1.1 client for Node.js contains a high-severity vulnerability (CVE-2026-13697) within its cache interceptor component. The flaw arises from incorrect parsing of the \u003ccode\u003eCache-Control\u003c/code\u003e header, specifically regarding the \u003ccode\u003eprivate\u003c/code\u003e directive.\u003c/p\u003e\n\u003cp\u003eTwo distinct vectors are identified. First, responses containing malformed qualified private directives (e.g., \u003ccode\u003eCache-Control: private=\u0026quot;\u0026quot;\u003c/code\u003e) fail the shared-cache security guard, causing user-specific responses to be stored in a shared cache. This results in subsequent users receiving cached data meant for others, including sensitive information like \u003ccode\u003eSet-Cookie\u003c/code\u003e headers. Second, a parse-time crash occurs when a server returns a \u003ccode\u003eCache-Control\u003c/code\u003e header containing both unqualified and qualified private directives (e.g., \u003ccode\u003epublic, max-age=60, private, private=\u0026quot;hdr\u0026quot;\u003c/code\u003e). This triggers an uncaught \u003ccode\u003eTypeError\u003c/code\u003e during parsing, which can lead to application process termination depending on how the error is handled by the consumer. The issue affects undici versions 7.x prior to 7.29.0 and 8.x prior to 8.9.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of the information disclosure vulnerability allows an attacker to gain unauthorized access to sensitive user data and session cookies of other users sharing the same cache key. The parse-time crash vulnerability poses a denial-of-service risk for applications using the cache interceptor, as a malicious or misconfigured upstream server can force the client process to crash by sending specifically crafted headers. The scope covers any application utilizing \u003ccode\u003eundici\u003c/code\u003e with the \u003ccode\u003einterceptors.cache()\u003c/code\u003e functionality enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003eundici\u003c/code\u003e version 7.29.0 or 8.9.0 immediately to apply the patch normalizing cache directive arrays.\u003c/li\u003e\n\u003cli\u003eAudit applications currently using \u003ccode\u003einterceptors.cache()\u003c/code\u003e to determine if they are in shared mode.\u003c/li\u003e\n\u003cli\u003eUntil the upgrade is deployed, configure the cache interceptor to use \u003ccode\u003etype: 'private'\u003c/code\u003e or disable caching for untrusted origins if possible.\u003c/li\u003e\n\u003cli\u003eImplement application-level error handling for undici request promises to catch and recover from potential \u003ccode\u003eTypeError\u003c/code\u003e exceptions during response header parsing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T20:48:13Z","date_published":"2026-08-03T20:48:13Z","id":"https://feed.craftedsignal.io/briefs/2026-08-undici-cache-vulnerability/","summary":"The undici library is susceptible to cache poisoning leading to information disclosure and application crashes due to improper handling of malformed Cache-Control directives in the cache interceptor.","title":"Information Disclosure and Denial of Service in Undici Cache Interceptor","url":"https://feed.craftedsignal.io/briefs/2026-08-undici-cache-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Undici (7.x \u003c 7.29.0)","version":"https://jsonfeed.org/version/1.1"}