Cache Interceptor Vulnerability in undici Affects User Authentication

CVE-2026-14643

What is CVE-2026-14643?

The undici library's cache interceptor has a flaw that mishandles optional whitespace surrounding the equals sign in Cache-Control directives. This issue affects undici versions 7.0.0 through before 7.29.0 and 8.0.0 through before 8.9.0. As a result, the parser may incorrectly drop the directive or store field names with literal quotes, leading to failures in cache decision-making. In shared-cache mode, this vulnerability can allow a response containing authenticated user data to be erroneously served to unauthorized users when requests share the same cache key. The vulnerability particularly affects applications that employ the cache interceptor in shared mode and forward Authorization headers, while responding to cacheable requests with improperly formatted directives. The issue has been resolved in undici versions 7.29.0 and 8.9.0.

References