Two distinct vectors are identified. First, responses containing malformed qualified private directives (e.g., Cache-Control: private="") fail the shared-cache security guard, causing user-specific responses to be stored in a shared cache. This results in subsequent users receiving cached data meant for others, including sensitive information like Set-Cookie headers. Second, a parse-time crash occurs when a server returns a Cache-Control header containing both unqualified and qualified private directives (e.g., public, max-age=60, private, private="hdr"). This triggers an uncaught TypeError during parsing, which can lead to application process termination depending on how the error is handled by the consumer. The issue affects undici versions 7.x prior to 7.29.0 and 8.x prior to 8.9.0.

Impact

Successful exploitation of the information disclosure vulnerability allows an attacker to gain unauthorized access to sensitive user data and session cookies of other users sharing the same cache key. The parse-time crash vulnerability poses a denial-of-service risk for applications using the cache interceptor, as a malicious or misconfigured upstream server can force the client process to crash by sending specifically crafted headers. The scope covers any application utilizing undici with the interceptors.cache() functionality enabled.

Recommendation

• Upgrade to undici version 7.29.0 or 8.9.0 immediately to apply the patch normalizing cache directive arrays.
• Audit applications currently using interceptors.cache() to determine if they are in shared mode.
• Until the upgrade is deployed, configure the cache interceptor to use type: 'private' or disable caching for untrusted origins if possible.
• Implement application-level error handling for undici request promises to catch and recover from potential TypeError exceptions during response header parsing.