PT-2026-50515 · Undici · Undici

Andrewmohawk + 2 · Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-9678

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions undici versions prior to 7.28.0 undici versions prior to 8.5.0

Description The cache interceptor incorrectly classifies certain responses as cacheable when the upstream Cache-Control header contains whitespace-padded qualified private or no-cache field names, such as private=" authorization" or no-cache="tauthorization". Because the parser preserves this surrounding whitespace, comparisons against the literal authorization field name fail, causing the response to be stored. In shared-cache mode, this can lead to cross-user information disclosure, where a response containing one user's authenticated data is served from the cache to a subsequent caller, including unauthenticated users, if both requests share the same cache key.

Recommendations Upgrade to version 7.28.0. Upgrade to version 8.5.0. Disable shared-cache mode for traffic that includes Authorization headers. Avoid caching responses to authenticated requests. Add Vary: Authorization upstream.

Fix

Weakness Enumeration

CWE-524

Related Identifiers

CVE-2026-9678

Affected Products

Undici

References · 4

• https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6 · Note
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/kom_256/status/2067293747813978586 · Twitter Post
• https://twitter.com/CVEnew/status/2067351019894235433 · Twitter Post