CVE-2026-13697 Details
Description
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
A vulnerability exists in the cache interceptor of undici versions 7.0.0 prior to 7.29.0 and 8.0.0 prior to 8.9.0. The issue arises from improper handling of malformed 'Cache-Control' private directives. Responses with degenerate qualified private directives, such as 'private' set to an empty value, can be incorrectly stored in the default shared cache. This cached response may later be served to a different user with the same cache key, unintentionally disclosing private response bodies and headers, including 'Set-Cookie'. Additionally, 'Cache-Control' headers that mix unqualified private directives with qualified ones can cause an uncaught TypeError in the cache-control parser, leading to a request rejection and potentially terminating the process, depending on the error handling implemented by the consumer.
Users can upgrade to undici version 7.29.0 or 8.9.0, both of which address the vulnerability by properly handling qualified private directives and preventing the associated cache and parsing issues.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272 | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | openjs |
| CWE-248 | Uncaught Exception | openjs |
| CWE-525 | Use of Web Browser Cache Containing Sensitive Information | openjs |
Affected Products
| Product | Versions |
|---|---|
| nodejs undici | >= 7.0.0, < 7.29.0 >= 8.0.0, < 8.9.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | openjs |