{"id":"CVE-2026-9678","aliases":["GHSA-pr7r-676h-xcf6"],"url":"https://o3.security/vulnerability/CVE-2026-9678","summary":"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass","details":"## Impact\n\nUndici's cache interceptor incorrectly classifies some responses as cacheable when the upstream `Cache-Control` header uses whitespace-padded qualified `private` or `no-cache` field names such as `private=\" authorization\"` or `no-cache=\"\\tauthorization\"`. The parser preserves the surrounding whitespace, so later comparisons against the literal `authorization` field name fail and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.\n\nAffected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with non-canonical qualified `private` or `no-cache` directives.\n\n## Patches\n\nUpgrade to undici v7.28.0 or v8.5.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.","published":"2026-06-17T17:04:09.680Z","modified":"2026-10-21T02:30:18.629519128Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00388,"percentile":0.32665,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"7.28.0"},{"ecosystem":"npm","name":"undici","fixedVersion":"8.5.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9678.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:18.629519128Z"}}