VulnSocial

CVE-2026-13697Disclosure(nodejs / undici)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch nodejs undici systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

nodejs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-200CWE-248CWE-525

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • undici

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-29); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
nodejs
Products
undici

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-29: 3Mentions · 2026-07-30: 1Patch / Workaround · 2026-07-29: 1Patch / Workaround · 2026-07-30: 1Technical Details · 2026-07-29: 3Technical Details · 2026-07-30: 107-2907-30
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-293
Disclosure2Patch1
2026-07-301
Patch1
Full discourse4 posts
  • Ulises Gascón@kom_256
    Patch

    🚨 High-severity security fix in undici@7.29.0 and undici@8.9.0 just released! Patches CVE-2026-13697: cross-user information disclosure and parse-time crash via degenerate private cache directives https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272

    Post summary

    Node’s undici library released a high‑severity fix for CVE‑2026‑13697, addressing cross‑user information disclosure and parse‑time crashes triggered by degenerate private cache directives.

    11072450
    5.5K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - Undici Cache Interceptor Private Response Leak + Parse DoS (CVE-2026-13697) undici cache interceptor misparses Cache-Control: private directives: degenerate qualified private (e.g., private="") can be cached in shared mode and later served cross-caller, leaking bodies/headers (incl. Set-Cookie). A mixed unqualified+qualified private can also throw an uncaught TypeError during parsing, rejecting requests and possibly crashing the process. Non-shared cache mode isn’t impacted. 👉Affected: undici cache interceptor in shared mode < 7.29.0 (7.x) / < 8.9.0 (8.x) | Upgrade to 7.29.0 or 8.9.0

    Post summary

    A high‑severity undici cache interceptor vulnerability that leaks response content and can trigger DoS is disclosed; upgrading to 7.29.0 or 8.9.0 mitigates the issue.

    0000074
    275 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-13697 undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carryin… https://www.cve.org/CVERecord?id=CVE-2026-13697 ----- Traducción: CVE-2026-13697: el… http://infoflow.cloud`

    Post summary

    The message announces CVE‑2026‑13697, noting that undici’s cache interceptor mishandles malformed Cache‑Control private directives in specific version ranges, and links to the official CVE record, but does not mention a PoC, exploit, patch, or active exploitation.

    0000028
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-13697 undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carryin… https://www.cve.org/CVERecord?id=CVE-2026-13697

    Post summary

    The text discloses a cache interceptor mishandling error in undici affecting specific version ranges, without mentioning exploitation, PoC, patches or false positives.

    000001.3K
    57.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnodejsundici-node.js-

Explore more

Back to dashboardnodejs CVEsundici vulnerabilities