CVE-2026-9678 Overview
CVE-2026-9678 affects Undici, the HTTP/1.1 client used by Node.js. The vulnerability resides in the cache interceptor, which incorrectly classifies responses as cacheable when the upstream Cache-Control header contains whitespace-padded qualified private or no-cache field names. Examples include private=" authorization" or no-cache="\tauthorization". The parser preserves surrounding whitespace, so comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, one user's authenticated response can be served to another caller, including unauthenticated requesters, when both requests resolve to the same cache key.
Critical Impact
Authenticated response data can leak across users in shared-cache deployments, exposing sensitive Authorization-bound content to unauthorized callers.
Affected Products
- Undici versions prior to v7.28.0 (v7.x branch)
- Undici versions prior to v8.5.0 (v8.x branch)
- Node.js applications using interceptors.cache() in shared mode that forward Authorization headers upstream
Discovery Timeline
- 2026-06-17 - CVE-2026-9678 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-9678
Vulnerability Analysis
The defect is an information exposure through caching issue [CWE-524]. HTTP Cache-Control directives such as private and no-cache may include a quoted, comma-separated list of header field names that must not be cached or must be revalidated. RFC 9111 requires implementations to compare these field names case-insensitively and after trimming optional whitespace.
Undici's interceptor does not strip leading or trailing whitespace inside the quoted list. As a result, a directive like private=" authorization" is parsed as the literal string " authorization" with a leading space. When the cache checks whether authorization is among the protected fields, the comparison fails. The response is then treated as fully cacheable, even though it contains data tied to a specific user's Authorization header.
Root Cause
The root cause is improper input normalization in the Cache-Control directive parser. Field-name tokens are stored verbatim rather than normalized per RFC 9110 and RFC 9111. Any upstream service emitting non-canonical but standards-tolerant Cache-Control values produces responses Undici will store in its shared cache.
Attack Vector
An attacker does not need to compromise the upstream. The condition is triggered when an upstream legitimately emits whitespace-padded qualified directives. Once a victim's authenticated response is cached, any subsequent request matching the same cache key receives the cached body. Anonymous callers can therefore retrieve another user's data. Exploitation requires the application to enable interceptors.cache() in shared mode and forward Authorization headers upstream, which raises attack complexity.
No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-pr7r-676h-xcf6 for technical details.
Detection Methods for CVE-2026-9678
Indicators of Compromise
- Cached responses in Undici's shared cache containing user-specific data that should be tied to an Authorization header.
- Upstream responses emitting Cache-Control: private=" authorization" or no-cache="\tauthorization" style directives with embedded whitespace.
- Application logs showing identical response bodies served to requests from different authenticated principals.
Detection Strategies
- Inventory Node.js services and identify those importing undici with versions below v7.28.0 or v8.5.0.
- Audit code for calls to interceptors.cache() combined with forwarding of Authorization headers.
- Inspect upstream services for non-canonical Cache-Control directives using HTTP traffic capture or proxy logs.
Monitoring Recommendations
- Log cache hits and the originating principal to detect responses served across user identities.
- Alert on outbound responses containing Cache-Control values with quoted field lists that include whitespace.
- Track dependency versions in CI/CD pipelines and fail builds on vulnerable undici releases.
How to Mitigate CVE-2026-9678
Immediate Actions Required
- Upgrade Undici to v7.28.0 or v8.5.0 or later across all affected Node.js services.
- Identify applications that call interceptors.cache() in shared mode and review whether Authorization headers are forwarded.
- Invalidate or purge existing shared caches that may contain leaked authenticated responses.
Patch Information
The maintainers released fixed versions undici v7.28.0 and undici v8.5.0. Refer to the GitHub Security Advisory GHSA-pr7r-676h-xcf6 and the OpenJS Foundation Security Advisories for release notes and patch commits.
Workarounds
- Disable shared-cache mode for any traffic that carries Authorization headers.
- Avoid caching responses to authenticated requests by scoping the cache interceptor to anonymous endpoints.
- Add Vary: Authorization to upstream responses to ensure cache keys differentiate per credential.
- Strip or normalize non-canonical Cache-Control directives at an intermediate proxy before they reach Undici.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
