CVE-2026-14643 in undici
Summary
by MITRE • 07/30/2026
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in undici's cache interceptor represents a critical security flaw that undermines cache isolation mechanisms when processing Cache-Control directives with optional whitespace around equals signs. This issue affects versions from 7.0.0 through 7.28.9 and 8.0.0 through 8.8.9, where the parser fails to properly handle qualified no-cache or private Cache-Control directives that contain whitespace padding around the equals sign. The technical implementation flaw stems from inadequate normalization of Cache-Control directive parsing, specifically failing to account for whitespace variations that are legally permitted in HTTP caching standards but not properly handled by the interceptor's validation logic.
The operational impact of this vulnerability extends beyond simple cache misbehavior to create serious data leakage scenarios in shared-cache environments. When a response containing authenticated user data is cached under a shared key, the improper parsing allows subsequent requests from different users—including completely unauthenticated ones—to receive cached responses that should remain isolated. This occurs because the cache decision logic fails to recognize the qualification of the Cache-Control directive due to the parser storing field names with literal quote characters rather than properly interpreting the directive. The vulnerability specifically affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and process cacheable responses containing qualified directives with whitespace around equals signs.
This security issue directly relates to CWE-200 (Information Exposure) and CWE-1236 (Improper Neutralization of Input During Web Page Generation) while mapping to ATT&CK technique T1566.001 (Phishing: Spearphishing Attachment) and T1071.004 (Application Layer Protocol: DNS) through potential exploitation pathways involving cached sensitive data exposure. The vulnerability is particularly dangerous in shared caching scenarios where multiple users or applications share the same cache keys, as it creates a situation where authenticated responses can be served to unauthorized parties. The fix implemented in versions 7.29.0 and 8.9.0 addresses this by normalizing whitespace handling around equals signs in Cache-Control directive parsing, ensuring that qualified no-cache and private directives are properly recognized and enforced regardless of spacing variations.
The root cause lies in the HTTP cache control specification compliance where whitespace around equals signs in directives is legally permitted but not consistently handled by undici's parser implementation. This creates a parsing inconsistency that allows cache bypass conditions where responses should be excluded from caching due to qualified directives but are instead stored and served to unauthorized users. The vulnerability demonstrates how seemingly minor parsing edge cases can create significant security implications in caching systems, particularly when dealing with authentication boundaries and shared resource access patterns in web applications. Organizations using undici in production environments must urgently upgrade to patched versions to prevent potential exposure of sensitive data through improper cache isolation mechanisms.