CVE-2026-14643

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.28.x undici versions 8.0.0 through 8.8.x

Description The cache interceptor mishandles optional whitespace around the equals sign in qualified no-cache or private Cache-Control directives. The parser may drop the directive or store a field name containing literal quote characters, causing the cache decision to ignore the qualification and store the response. In shared-cache mode, this can lead to a response containing one user's authenticated data being served to a subsequent caller, including unauthenticated users, if both requests share the same cache key. This issue affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives containing whitespace around the equals sign.

Recommendations Update to version 7.29.0. Update to version 8.9.0.