{"id":"GHSA-jr45-8vmc-qm54","summary":"undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives","details":"## Impact\n\nUndici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cache` or `private` Cache-Control directive, such as `no-cache =\"authorization\"` (OWS before `=`) or `no-cache= \"authorization\"` (OWS after `=`). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-`=` bypass that the earlier fix did not normalize.\n\nAffected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with qualified `private` or `no-cache` directives whose field-name list is padded with OWS around the `=`.\n\n## Patches\n\nUpgrade to undici v7.29.0 or v8.9.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.","aliases":["CVE-2026-14643"],"modified":"2026-08-03T19:45:08.712190448Z","published":"2026-08-03T19:32:12Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-08-03T19:32:12Z","nvd_published_at":"2026-07-29T22:16:52Z","cwe_ids":["CWE-436","CWE-524"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14643"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"}],"affected":[{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-jr45-8vmc-qm54/GHSA-jr45-8vmc-qm54.json"}},{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-jr45-8vmc-qm54/GHSA-jr45-8vmc-qm54.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}