CVE-2026-13697: undici Information Disclosure Vulnerability

CVE-2026-13697 Overview

CVE-2026-13697 is a high-severity information disclosure vulnerability in undici, the Node.js HTTP/1.1 client maintained by the OpenJS Foundation. The flaw affects undici versions 7.0.0 through 7.28.x and 8.0.0 through 8.8.x when applications use the cache interceptor in shared mode, which is the default configuration. A malformed Cache-Control: private directive can cause private responses to be stored in the shared cache and served to unrelated callers sharing the same cache key. A related parsing defect can also crash the consuming process. Both issues are fixed in undici 7.29.0 and 8.9.0.

Critical Impact
Private response bodies and sensitive headers including Set-Cookie can leak across users. A separate uncaught TypeError in the cache-control parser can terminate Node.js processes, enabling denial of service.

Affected Products

undici 7.0.0 up to (but not including) 7.29.0
undici 8.0.0 up to (but not including) 8.9.0
Node.js applications using undici's cache interceptor in shared mode (default)

Discovery Timeline

2026-07-29 - CVE-2026-13697 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-13697

Vulnerability Analysis

The defect resides in undici's cache interceptor, which implements HTTP caching semantics per RFC 9111. The interceptor is expected to prevent shared caching of responses marked as private. The parser fails to correctly interpret degenerate qualified private directives such as private="" (empty value). Instead of treating the response as uncacheable in a shared cache, the interceptor stores it. A later request with the same cache key retrieves the stored response, exposing the original caller's response body and headers, including Set-Cookie. This maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

A second defect exists in the same cache-control parser. When a Cache-Control header combines an unqualified private directive with a qualified one (for example, private, private="x"), the parser throws an uncaught TypeError. Depending on how the calling application handles rejected requests, the unhandled exception can terminate the Node.js process.

Root Cause

The root cause is improper input validation in the Cache-Control header parser. The parser does not normalize the two syntactic forms of the private directive and does not enforce that malformed values disqualify a response from shared caching. The absence of a defensive fallback path allows exceptions to escape the interceptor.

Attack Vector

An attacker controls or influences an upstream response that includes a malformed private directive. Any downstream service using undici's shared cache stores that response. Subsequent requests hitting the same cache key receive the sensitive payload of an earlier requester. Exploitation requires network access to trigger requests through the vulnerable client but no authentication or user interaction. The attack complexity is elevated because the attacker must influence upstream headers and coincide with cache-key collisions.

Refer to the GitHub Security Advisory GHSA-4cwx-7wf7-3272 for the maintainer's technical description.

Detection Methods for CVE-2026-13697

Indicators of Compromise

Node.js process crashes with an uncaught TypeError originating from undici's cache-control parser stack frames.
Application logs showing responses with Set-Cookie or user-specific bodies being returned to unauthenticated or unrelated sessions.
Presence of vulnerable undici versions (7.0.0–7.28.x, 8.0.0–8.8.x) in package-lock.json or node_modules.
HTTP responses observed with malformed Cache-Control directives such as private="" or private, private="...".

Detection Strategies

Perform Software Composition Analysis (SCA) across build pipelines and container images to enumerate undici versions in direct and transitive dependencies.
Instrument HTTP client middleware to log Cache-Control values and flag responses containing qualified private directives with empty or duplicated forms.
Capture and review Node.js crash dumps and process restart events for stack traces referencing undici cache modules.

Monitoring Recommendations

Aggregate application and runtime logs in a centralized analytics platform to correlate undici crashes with upstream response patterns.
Alert on repeated uncaughtException events in Node.js services that route traffic through undici.
Track cache-hit anomalies where response bodies vary for identical cache keys across sessions.

How to Mitigate CVE-2026-13697

Immediate Actions Required

Upgrade undici to 7.29.0 for the 7.x line or 8.9.0 for the 8.x line without delay.
Inventory all Node.js services and container images that pull undici directly or transitively (for example, through fetch in modern Node.js runtimes).
Rotate any credentials or session tokens that may have been exposed through shared cache reuse if the interceptor was enabled in production.

Patch Information

The OpenJS Foundation and undici maintainers released fixed versions on the same coordinated disclosure. Apply undici >=7.29.0 for the 7.x branch or >=8.9.0 for the 8.x branch. Consult the OpenJS Foundation Security Advisories and GitHub Security Advisory GHSA-4cwx-7wf7-3272 for release notes and commit references.

Workarounds

Disable undici's cache interceptor until upgrade is possible, or configure it in non-shared mode where responses are scoped per caller.
Strip or normalize incoming Cache-Control headers at a trusted reverse proxy before responses reach undici clients.
Wrap undici client calls in error handlers that catch parser TypeError exceptions to prevent process termination pending patch deployment.

bash

# Configuration example
npm install undici@^8.9.0
# or for the 7.x line
npm install undici@^7.29.0

# Verify installed version
npm ls undici