CVE-2026-13697

Received Received - Intake

Cache Interceptor Cache-Control Private Directive Handling Flaws in Undici

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: openjs

Description

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-13697

Affected Vendors & Products

Vendor	Product	Version / Range
undici	undici	to 7.29.0 (exc)
undici	undici	to 8.9.0 (exc)
undici	undici	7.29.0
undici	undici	8.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-525	The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects the undici library's cache interceptor, which mishandles malformed Cache-Control private directives. It allows responses with improperly formatted private directives to be stored in a shared cache and served to unintended users, potentially exposing private data like response bodies and Set-Cookie headers. Additionally, combining unqualified and qualified private directives can cause an uncaught error that may crash the application.

Impact Analysis

If you use undici versions between 7.0.0-7.28.0 or 8.0.0-8.8.0 with the cache interceptor in shared mode, attackers could intercept sensitive data like session cookies or private responses. The vulnerability may also cause application crashes if malformed Cache-Control headers are processed.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance breaches if private user data is leaked due to improper cache handling.

Mitigation Strategies

Update undici to version 7.29.0 or later if using version 7.x, or to version 8.9.0 or later if using version 8.x. This addresses the cache interceptor issues with malformed Cache-Control private directives and prevents unauthorized data disclosure.

Hi! I’m here to help you understand CVE-2026-13697. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70