CVE-2026-14643 undici Vulnerable to Cross-User Information Disclosure

CVE-2026-14643: undici Vulnerable to Cross-User Information Disclosure

🚨 Overview: CVE-2026-14643 highlights a vulnerability in undici that allows for cross-user information disclosure due to improper handling of whitespace around the equals sign in Cache-Control directives.

📅 Date Published: July 29, 2026

Details

This vulnerability was published on July 29, 2026, at 10:16 p.m. The issue arises when undici’s cache interceptor mishandles optional whitespace around the equals sign of a qualified no-cache or private Cache-Control directive. Affected versions include undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0. The parser may either drop the directive or store a field name with literal quote characters, leading to cache decisions that fail to recognize the qualification, resulting in unintended data exposure.

Impact

In shared-cache mode, this vulnerability can allow a response containing one user’s authenticated data to be served from cache to a later caller, including unauthenticated users, when both requests resolve to the same cache key. This issue particularly affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with improperly formatted Cache-Control directives.

Severity

The CVSS 3.1 score for this vulnerability is 5.9, classified as MEDIUM severity. No affected products have been recorded yet.

Common Weakness Enumerations (CWEs)

• CWE-436: Interpretation Conflict
• CWE-524: Use of Cache Containing Sensitive Information

Related Attack Patterns

• CAPEC-34: HTTP Response Splitting
• CAPEC-105: HTTP Request Splitting
• CAPEC-273: HTTP Response Smuggling
• CAPEC-204: Lifting Sensitive Data Embedded in Cache

Recommended Solution

To mitigate this vulnerability, it is recommended to update undici to patch cache handling issues related to Cache-Control directives. Specifically, update to version 7.29.0 or later, or to version 8.9.0 or later. Organizations should also ensure that Cache-Control directives are parsed correctly and validate cache behavior in shared mode.

For more information, please refer to the Read full article.