GHSA-jr45-8vmc-qm54: Medium severity npm/undici vulnerability
Impact
Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-= bypass that the earlier fix did not normalize.
Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives whose field-name list is padded with OWS around the =.
Patches
Upgrade to undici v7.29.0 or v8.9.0.
Workarounds
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.9.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.29.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.29.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.9.0 - Configuration
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers to avoid authenticated responses being served from cache to other callers.
Undici cache interceptor (interceptors.cache()) shared-cache mode behavior for requests containing Authorization headers = disable shared-cache mode - Configuration
If upgrade is not immediately possible, avoid caching responses to authenticated requests to prevent cross-user data exposure.
Undici cache interceptor (interceptors.cache()) caching behavior for authenticated requests = avoid caching cacheable responses to authenticated requests - Configuration
If upgrade is not immediately possible, add `Vary: Authorization` upstream so cache decisions differentiate by the presence/value of the `Authorization` header.
Upstream response headers (via proxy/server in front of Undici) Vary header = add Vary: Authorization
Event History
Frequently Asked Questions
What is the severity of GHSA-jr45-8vmc-qm54?
The severity of GHSA-jr45-8vmc-qm54 is categorized as medium with a score of 5.9.
How do I fix GHSA-jr45-8vmc-qm54?
To fix GHSA-jr45-8vmc-qm54, update to the latest version of the Undici package that addresses this vulnerability.
What software is affected by GHSA-jr45-8vmc-qm54?
GHSA-jr45-8vmc-qm54 affects the npm package Undici.
What is the impact of GHSA-jr45-8vmc-qm54?
GHSA-jr45-8vmc-qm54 allows optional whitespace to be mishandled in Cache-Control directives, potentially leading to issues with caching behavior.
When was GHSA-jr45-8vmc-qm54 published?
GHSA-jr45-8vmc-qm54 was published on August 3, 2026.