CVE-2026-9678: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
Impact
Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.
Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.
Patches
Upgrade to undici v7.28.0 or v8.5.0.
Workarounds
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
Other sources
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.
Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.
Patches: Upgrade to undici v7.28.0 or v8.5.0.
Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Configuration
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers.
undici cache interceptor shared-cache mode (interceptors.cache() shared mode) for requests that include Authorization headers = disable for traffic with Authorization headers - Configuration
If upgrade is not immediately possible, avoid caching responses to authenticated requests.
undici cache interceptor caching policy for authenticated requests = avoid caching cacheable responses to authenticated requests - Configuration
If upgrade is not immediately possible, add Vary: Authorization upstream.
upstream HTTP response headers Vary header = add Vary: Authorization
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9678?
CVE-2026-9678 has a severity rating of medium with a score of 5.9.
What is the impact of CVE-2026-9678?
CVE-2026-9678 allows for cross-user information disclosure through a shared cache whitespace bypass.
How does CVE-2026-9678 affect Undici's cache handling?
CVE-2026-9678 causes the cache interceptor in Undici to incorrectly classify certain responses as cacheable due to mishandling of whitespace in Cache-Control headers.
How do I mitigate CVE-2026-9678?
To mitigate CVE-2026-9678, users should ensure that Cache-Control headers do not include whitespace in qualified field names.
Is there a fix available for CVE-2026-9678?
As of now, there are no specific patches or fixes published for CVE-2026-9678, so users should monitor Undici's updates for future releases.