crítica
CVE-2026-13697
undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta), Amazon (alta).
Descripción
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2023 | nodejs24, nodejs24-debuginfo, nodejs24-debugsource y 7 más | 1:24.18.1-1.amzn2023.0.2 y 2 más |
| chainguard | code-server, commercial-gitlab-rails-ee-19.1, commercial-gitlab-rails-ee-19.2 y 15 más | 4.130.0-r5 y 14 más |
| debian 12 | node-undici | sin corrección indicada |
| debian 13 | node-undici | sin corrección indicada |
| debian 14 | node-undici | 8.9.0+dfsg+~cs3.2.0-1 |
| echo | node-undici | sin corrección indicada |
| echo npm::Echo OSV | undici | 7.29.0 |
| minimos | ghost, hermes-agent, kibana-9.4 y 7 más | 6.67.0-r0 y 9 más |
| npm::GitHub Security Advisory npm | undici | 7.29.0, 8.9.0 |
| rapidfort amazon linux 2023 | nodejs, nodejs20, nodejs24 y 5 más | 1:24.18.1-1.amzn2023.0.2 y 1 más |
| rapidfort debian 12 | node-undici | 0:8.9.0+dfsg+~cs3.2.0-1 |
| rapidfort debian 13 | node-undici | 0:8.9.0+dfsg+~cs3.2.0-1 |
Mostrar las 66 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2023 | nodejs24 | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-debuginfo | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-debugsource | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-devel | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-docs | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-full-i18n | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-libs | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-libs-debuginfo | 1:24.18.1-1.amzn2023.0.2 |
| amazon linux 2023 | nodejs24-npm | 1:11.16.0-1.24.18.1.1.amzn2023.0.2 |
| amazon linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.18.1.1.amzn2023.0.2 |
| chainguard | code-server | 4.130.0-r5 |
| chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| chainguard | kibana-9.2 | 9.2.8-r19 |
| chainguard | kibana-9.3 | 9.3.8-r5 |
| chainguard | langfuse-3 | 3.225.7-r6 |
| chainguard | langfuse-4 | 4.3.1-r3 |
| chainguard | langfuse-fips-3 | 3.224.3-r9 |
| chainguard | langfuse-fips-4 | 4.4.0-r0 |
| chainguard | pelias-api | 7.8.0-r7 |
| chainguard | renovate | 44.11.4-r0 |
| chainguard | vitess-24 | 24.0.3-r7 |
| debian 12 | node-undici | sin corrección indicada |
| debian 13 | node-undici | sin corrección indicada |
| debian 14 | node-undici | 8.9.0+dfsg+~cs3.2.0-1 |
| echo | node-undici | sin corrección indicada |
| echo npm::Echo OSV | undici | 7.29.0 |
| minimos | ghost | 6.67.0-r0 |
| minimos | hermes-agent | 2026.8.13-r0 |
| minimos | kibana-9.4 | 9.4.6-r0 |
| minimos | kibana-9.5 | 9.5.2-r0 |
| minimos | langfuse-4 | 4.4.0-r0 |
| minimos | mcp-context7 | 4.1.3-r0 |
| minimos | n8n | 2.35.3-r0 |
| minimos | node-gyp | 13.0.2-r0 |
| minimos | openclaw | 2026.8.1-r0 |
| minimos | trigger-dev | 4.5.11-r1 |
| npm::GitHub Security Advisory npm | undici | 7.29.0, 8.9.0 |
| rapidfort amazon linux 2023 | nodejs | sin corrección indicada |
| rapidfort amazon linux 2023 | nodejs20 | sin corrección indicada |
| rapidfort amazon linux 2023 | nodejs24 | 1:24.18.1-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | nodejs24-devel | 1:24.18.1-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | nodejs24-docs | 1:24.18.1-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | nodejs24-full-i18n | 1:24.18.1-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | nodejs24-libs | 1:24.18.1-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | nodejs24-npm | 1:11.16.0-1.24.18.1.1.amzn2023.0.2 |
| rapidfort debian 12 | node-undici | 0:8.9.0+dfsg+~cs3.2.0-1 |
| rapidfort debian 13 | node-undici | 0:8.9.0+dfsg+~cs3.2.0-1 |
| Red Hat | nodejs:26::nodejs | sin corrección indicada |
| Red Hat | nodejs:26::nodejs-docs | sin corrección indicada |
| Red Hat | nodejs:26::nodejs-full-i18n | sin corrección indicada |
| Red Hat | nodejs:26::nodejs-libs | sin corrección indicada |
| Red Hat | nodejs:26::npm | sin corrección indicada |
| Red Hat | openshift4/ose-monitoring-plugin-rhel9 | sin corrección indicada |
| seal npm::Seal Security Database | @seal-security/undici | 7.18.2-sp999, 7.19.2-sp2p2, 7.22.0-sp999 |
| seal npm::Seal Security Database | undici | 7.18.2-sp999, 7.19.2-sp2p2, 7.22.0-sp999 |
| wolfi | code-server | 4.130.0-r5 |
| wolfi | langfuse-3 | 3.225.7-r6 |
| wolfi | renovate | 44.11.4-r0 |
| wolfi | vitess-24 | 24.0.3-r7 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-13697
- https://advisory.echohq.com/cve/CVE-2026-13697
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451
- https://github.com/nodejs/undici/releases/tag/v7.29.0
- https://github.com/nodejs/undici/releases/tag/v8.9.0
- https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272