CVE-2026-13697 in undici
Summary
by MITRE • 07/29/2026
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in undici's cache interceptor represents a critical security flaw that undermines the fundamental principles of HTTP caching and privacy protection mechanisms. This issue affects versions prior to 7.29.0 and 8.9.0, where the cache interceptor fails to properly validate Cache-Control directives, creating potential pathways for sensitive data exposure. The core problem manifests in two distinct but related scenarios that compromise both data confidentiality and system stability. When a response contains malformed Cache-Control private directives such as private= with an empty value, the caching mechanism incorrectly stores these responses in the shared cache where they become accessible to different clients using the same cache key. This behavior directly violates HTTP caching standards and creates a significant information disclosure risk.
The technical implementation flaw lies within the cache-control parser's handling of degenerate private directives, which should have been rejected during validation but instead are processed incorrectly. According to CWE-200, this constitutes improper output sanitization that leads to information exposure, while CWE-1294 addresses the improper handling of cache control directives in HTTP implementations. The vulnerability specifically targets the shared cache mode configuration, which is the default setting, making it particularly dangerous as it affects the majority of undici applications using caching features. When the Cache-Control header contains both unqualified and qualified private directives simultaneously, the parser encounters an uncaught TypeError that can cause process termination, representing a denial-of-service vector that aligns with ATT&CK technique T1499.3 for endpoint denial of service.
The operational impact of these vulnerabilities extends beyond simple data leakage to encompass system reliability concerns. Private response bodies and headers including Set-Cookie values become accessible to unauthorized parties when improperly cached responses are served to different callers, creating a serious privacy breach that violates user expectations and regulatory compliance requirements. The process termination vulnerability presents an additional attack surface where malicious actors could potentially cause application crashes through carefully crafted Cache-Control headers. Both issues affect applications using the default cache interceptor configuration, meaning that virtually all undici applications relying on caching are vulnerable unless explicitly configured otherwise. The shared cache mode represents a particularly problematic scenario because it allows responses to be cached across multiple client contexts, fundamentally undermining the privacy guarantees that private Cache-Control directives are designed to provide.
Mitigation strategies should focus on immediate version upgrades to 7.29.0 or 8.9.0 where the vulnerabilities have been addressed through proper validation and error handling mechanisms. Organizations should also implement additional monitoring for malformed Cache-Control headers and consider implementing defensive measures such as input sanitization layers that validate HTTP headers before they reach the cache interceptor. The fix addresses the root cause by properly validating private directive formats and implementing robust error handling that prevents process termination while maintaining the caching functionality's integrity. Security teams should review their application configurations to ensure that cache interceptors are not inadvertently exposed to untrusted input sources, and consider implementing additional access controls around caching operations. The vulnerability highlights the importance of proper HTTP header validation in web applications and demonstrates how seemingly minor parsing issues can lead to significant security implications when combined with caching mechanisms that handle sensitive data.