CVE-2026-9678 Details
Description
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
A vulnerability in the Node.js HTTP client library, Undici, allows for cross-user information disclosure through improper caching behavior. The issue arises in versions 7.0.0 prior to 7.28.0 and 8.0.0 prior to 8.5.0. When the cache interceptor is enabled in shared mode and Authorization headers are forwarded upstream, responses can be incorrectly classified as cacheable. This misclassification occurs when the upstream Cache-Control header includes whitespace-padded qualified private or no-cache field names, such as private=" authorization" or no-cache=" authorization". The parser retains the extra whitespace, causing later comparisons to fail and allowing the response to be cached. In shared-cache mode, this can result in a response containing one user's authenticated data being served to another user, including unauthenticated users, if both requests use the same cache key.
Users can upgrade to Undici versions 7.28.0 or 8.5.0. If an immediate upgrade is not possible, shared-cache mode can be disabled for traffic that includes Authorization headers, responses to authenticated requests can be excluded from caching, or a Vary: Authorization header can be added upstream.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6 | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-524 | Use of Cache Containing Sensitive Information | openjs |
Affected Products
| Product | Versions |
|---|---|
| nodejs undici | >= 7.0.0, < 7.28.0 >= 8.0.0, < 8.5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | openjs |