CVE-2026-13697
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles malformed Cache-Control private directives. A response with a private directive set to an empty value can be stored in the shared cache and served to other users, disclosing private data. Additionally, combining an unqualified and qualified private directive causes a TypeError that can crash the process.
Risk Assessment
Sensitive data such as Set-Cookie may be disclosed to unauthorized users, and the process may crash.
Recommendation
Update undici to version 7.29.0 or 8.9.0 (or later).
Other vulnerabilities in undici
See all- CVE-2026-15157Medium
In undici before versions 6.28.0, 7.29.0, and 8.9.0, the 'type' property of hand-rolled blob-like request bodies is not validated. An attacker can inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request.
- CVE-2026-14643Medium
In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles optional whitespace around the equals sign in Cache-Control directives. This can cause authenticated user data to be cached and served to other users.
- CVE-2026-16728Medium
In undici before versions 6.28.0, 7.29.0, and 8.9.0, the retry interceptor can deliver a response whose body length does not match the Content-Length header, potentially leading to response desynchronization, connection hangs, or response corruption.
- CVE-2026-16729Medium
The setCookie function in undici before versions 6.28.0, 7.29.0, and 8.9.0 does not fully sanitize cookie attributes. Domain values are not checked for semicolons, and unparsed array entries are not sanitized, allowing attacker-influenced input to inject additional attributes like SameSite, HttpOnly, or Secure without the caller's knowledge.
- CVE-2026-9697High
A vulnerability in the undici library causes the requestTls option to be silently dropped when using ProxyAgent with a SOCKS5 proxy. The HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store instead of user-configured settings.
- CVE-2026-9679Medium
Undici's cookie parser (parseSetCookie) decodes cookie values, which can lead to HTTP response header injection. Applications that forward parsed cookie values into response headers become vulnerable to attacks such as session fixation or malicious redirects.
- CVE-2026-9678Medium
A vulnerability in Undici allows incorrect classification of responses as cacheable when Cache-Control headers contain whitespace. This can lead to authenticated user data being served to another user from the cache.
- CVE-2026-6734High
In the undici library, a vulnerability allows Socks5ProxyAgent to reuse a single connection pool across different origins without verifying origin match. This causes cross-origin request routing, credential leakage, and potential HTTPS downgrade to HTTP.
- CVE-2026-11525Low
A vulnerability in undici allows the acceptance of incorrect SameSite attribute values in the Set-Cookie header, potentially leading to a weakening of the cookie's SameSite policy. Instead of the required case-insensitive exact match, values containing 'Strict', 'Lax', or 'None' as substrings are accepted.
- CVE-2026-12151High
The undici WebSocket client does not limit the number of message fragments, allowing a malicious server to send many small continuation frames. This causes unbounded memory growth and denial of service (DoS).
Original NVD description (English source)
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.