CVE-2026-9678Disclosure

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

Back to dashboard

0.5/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-06-17); latest day: 1
5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Disclosure

360.0%

Patch

120.0%

General

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-17	2	Disclosure1Patch1
2026-06-18	2	Disclosure2
2026-06-24	1	General1

Full discourse5 posts

Matteo Collina@matteocollina91d
Disclosure
🟡 Moderate: Shared-cache disclosure (CVE-2026-9678). The cache interceptor mishandled whitespace-padded Cache-Control like `private=" authorization"`, so authenticated responses could be cached & served to other users in shared mode. v7/v8. Fixed in 7.28.0 / 8.5.0.
Post summary
The text announces the discovery of a shared-cache disclosure (CVE-2026-9678), explains its technical mechanism, and notes the patch releases that address it.
10020294
57.8K followersView on X
Ulises Gascón@kom_25692d
Patch
🚨 Medium-severity security fix in undici (7.28.0, 8.5.0) just released! Patches CVE-2026-9678. undici vulnerable to cross-user information disclosure via shared cache whitespace bypass. https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6
Post summary
A medium‑severity fix for undici has been released, patching CVE‑2026‑9678, which allows cross‑user information disclosure through a shared cache whitespace bypass.
00020121
5.5K followersView on X
AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawk85d
General
I'll harp on about @OpenAI codex being awesome, and I see together we have another CVE in nodejs/undici https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6 https://www.cve.org/CVERecord?id=CVE-2026-9678
Post summary
The tweet simply references the CVE‑2026‑9678 advisory for nodejs/undici, providing links to the official pages, without supplying further technical, exploit, or mitigation information.
00100401
5.3K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-9678 Cache Bypass Vulnerability in Undici Allowing Unauthorized Access ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9678 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A tweet posts a link to a newly announced CVE (CVE‑2026‑9678) describing a cache bypass in Undici that could allow unauthorized access, with no additional technical details, exploits, or mitigation information.
0000047
4.1K followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-9678 Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or… https://www.cve.org/CVERecord?id=CVE-2026-9678
Post summary
The text announces CVE-2026-9678, explaining that Undici’s cache interceptor misclassifies responses due to whitespace in Cache‑Control headers; no PoC, exploit, patch, or active exploitation evidence is provided.
00000182
57.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-9678

Matteo Collina[verified]@matteocollinaDisclosure

The text announces the discovery of a shared-cache disclosure (CVE-2026-9678), explains its technical mechanism, and notes the patch releases that address it.

Ulises Gascón@kom_256Patch

A medium‑severity fix for undici has been released, patching CVE‑2026‑9678, which allows cross‑user information disclosure through a shared cache whitespace bypass.

AndrewMohawk⁽ⁿᵘˡˡ⁾@AndrewMohawkGeneral

The tweet simply references the CVE‑2026‑9678 advisory for nodejs/undici, providing links to the official pages, without supplying further technical, exploit, or mitigation information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A tweet posts a link to a newly announced CVE (CVE‑2026‑9678) describing a cache bypass in Undici that could allow unauthorized access, with no additional technical details, exploits, or mitigation information.

CVE@CVEnewDisclosure

The text announces CVE-2026-9678, explaining that Undici’s cache interceptor misclassifies responses due to whitespace in Cache‑Control headers; no PoC, exploit, patch, or active exploitation evidence is provided.