CVE-2026-14643Patch(nodejs / undici)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch nodejs undici systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.

nodejs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-436CWE-524

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

undici

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Peaked 1d ago at 1 mentions (2026-07-29); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

nodejs

Products

undici

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Patch

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Ulises Gascón@kom_25691d
Patch
🚨 Medium-severity security fix in undici@7.29.0 and undici@8.9.0 just released! Patches CVE-2026-14643: cross-user disclosure via whitespace around equals in Cache-Control directives https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54
Post summary
Node.js undici package released security patches for CVE-2026-14643, addressing a cross-user disclosure flaw involving whitespace in Cache-Control directives; the fixes are available in versions 7.29.0 and 8.9.0.
01021214
5.5K followersView on X
Abhinav Singwal@yogsec13d
Patch
CVE-2026-14643 undici cache interceptor mishandles optional whitespace around the equals sign of qualified no-cache or private Cache-Control directives. In versions 7.0.0 through 7.28.9 and 8.0.0 through 8.8.9, the parser either drops the directive or stores a field name with literal quote characters, causing the cache decision to fail. In shared-cache mode, authenticated responses can be served to unauthenticated callers when both requests resolve to the same cache key. Fixed in undici 7.29.0 and 8.9.0. CWE-436 Interpretation Conflict. https://nvd.nist.gov/vuln/detail/CVE-2026-14643 #CVE #undici #CachePoisoning #InformationDisclosure
Post summary
The text announces CVE-2026-14643, a cache poisoning and information disclosure vulnerability in undici's cache interceptor caused by mishandled whitespace in Cache-Control directives, and specifies the fixed versions (7.29.0 and 8.9.0).
0000050
567 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nodejs	undici	-	node.js	-

Explore more

Back to dashboard nodejs CVEs undici vulnerabilities