CVE-2026-13697

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x

Description The cache interceptor mishandles malformed Cache-Control private directives when used in shared mode. A degenerate qualified private directive, such as private set to an empty value, can cause a response to be stored in the default shared cache and subsequently served to different callers with the same cache key. This leads to the disclosure of private response bodies and headers, including Set-Cookie. Additionally, combining an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and may terminate the process depending on the consumer's error handling.

Recommendations Update undici versions 7.0.0 through 7.28.x to version 7.29.0. Update undici versions 8.0.0 through 8.8.x to version 8.9.0.