Improper Cache Handling Vulnerability in Undici by Node.js

CVE-2026-9678

What is CVE-2026-9678?

A vulnerability in the Undici HTTP client allows for improper cache handling, where responses containing sensitive user data may be incorrectly cached and served to unauthorized users. This occurs when the cache interceptor is enabled in shared mode and forwards Authorization headers while handling responses with non-canonical cache directives. As a result, a user’s authenticated information can be exposed to subsequent requests from other users, potentially leading to significant privacy breaches. To mitigate this risk, users should upgrade to the latest versions of Undici or implement workarounds such as disabling shared-cache mode for Authorization-requesting traffic.

References