CVE-2026-9678
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
Description
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
INFO
Published Date :
June 17, 2026, 6:18 p.m.
Last Modified :
June 25, 2026, 5:44 p.m.
Remotely Exploit :
No
Source :
ce714d77-add3-4f53-aff5-83d477b104bb
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | ce714d77-add3-4f53-aff5-83d477b104bb | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Upgrade Undici to v7.28.0 or v8.5.0.
- Disable shared-cache mode if upgrade is not possible.
- Avoid caching responses to authenticated requests.
- Add Vary: Authorization header upstream.
Public PoC/Exploit Available at Github
CVE-2026-9678 has a 2 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-9678.
| URL | Resource |
|---|---|
| https://cna.openjsf.org/security-advisories.html | Vendor Advisory |
| https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6 | Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-9678 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-9678
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Dockerfile
NV Digital Open Operator System (NVoOS) is an Object-Oriented AI framework for WordPress connecting your data with OpenAI, Gemini, Anthropic, DeepSeek, Hugging Face, Cloudflare, OpenRouter & Ollama (Local) models. Create & manage AI Assistants that can interact with users, access WordPress (API) data, & perform as a MCP Server & Chat Agent
ai ai-agents ai-tools antropic-claude cloudflare-workers-ai google-gemini huggingface lm-studio mcp ollama-api ollama-client openai-api wordpress-plugin
PHP CSS JavaScript Shell HTML Python Dockerfile TypeScript Batchfile SCSS
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-9678 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-9678 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jun. 25, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* versions from (including) 8.0.0 up to (excluding) 8.5.0 *cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* versions from (including) 7.0.0 up to (excluding) 7.28.0 Added Reference Type openjs: https://cna.openjsf.org/security-advisories.html Types: Vendor Advisory Added Reference Type openjs: https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6 Types: Mitigation, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-9678', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-17T18:05:24.378630Z'} -
New CVE Received by ce714d77-add3-4f53-aff5-83d477b104bb
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'undici', 'product': 'undici', 'versions': [{'status': 'affected', 'version': '7.0.0', 'lessThan': '7.28.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.28.0', 'versionType': 'semver'}, {'status': 'affected', 'version': '8.0.0', 'lessThan': '8.5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '8.5.0', 'versionType': 'semver'}], 'packageURL': 'pkg:npm/undici', 'defaultStatus': 'unaffected'}] Added Description Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-524 Added Reference https://cna.openjsf.org/security-advisories.html Added Reference https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6