Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-13697

critical

CVE-2026-13697

undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives

Published Modified CWE 200, 248, 525
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), Amazon (high).

Description

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

Affected packages and fixed versions

SourcePackageFixed in
amazon linux 2023nodejs24, nodejs24-debuginfo, nodejs24-debugsource and 7 more1:24.18.1-1.amzn2023.0.2 and 2 more
chainguardcode-server, commercial-gitlab-rails-ee-19.1, commercial-gitlab-rails-ee-19.2 and 15 more4.130.0-r5 and 14 more
debian 12node-undicino fix listed
debian 13node-undicino fix listed
debian 14node-undici8.9.0+dfsg+~cs3.2.0-1
echonode-undicino fix listed
echo npm::Echo OSVundici7.29.0
minimosghost, hermes-agent, kibana-9.4 and 7 more6.67.0-r0 and 9 more
npm::GitHub Security Advisory npmundici7.29.0, 8.9.0
rapidfort amazon linux 2023nodejs, nodejs20, nodejs24 and 5 more1:24.18.1-1.amzn2023.0.2 and 1 more
rapidfort debian 12node-undici0:8.9.0+dfsg+~cs3.2.0-1
rapidfort debian 13node-undici0:8.9.0+dfsg+~cs3.2.0-1
Show all 66 entries from 15 sources
SourcePackageFixed in
amazon linux 2023nodejs241:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-debuginfo1:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-debugsource1:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-devel1:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-docs1:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-full-i18n1:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-libs1:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-libs-debuginfo1:24.18.1-1.amzn2023.0.2
amazon linux 2023nodejs24-npm1:11.16.0-1.24.18.1.1.amzn2023.0.2
amazon linux 2023v8-13.6-devel3:13.6.233.17-1.24.18.1.1.amzn2023.0.2
chainguardcode-server4.130.0-r5
chainguardcommercial-gitlab-rails-ee-19.119.1.7-r3
chainguardcommercial-gitlab-rails-ee-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-19.419.4.1-r1
chainguardcommercial-gitlab-rails-ee-fips-19.119.1.9-r0
chainguardcommercial-gitlab-rails-ee-fips-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-fips-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-fips-19.419.4.1-r1
chainguardkibana-9.29.2.8-r19
chainguardkibana-9.39.3.8-r5
chainguardlangfuse-33.225.7-r6
chainguardlangfuse-44.3.1-r3
chainguardlangfuse-fips-33.224.3-r9
chainguardlangfuse-fips-44.4.0-r0
chainguardpelias-api7.8.0-r7
chainguardrenovate44.11.4-r0
chainguardvitess-2424.0.3-r7
debian 12node-undicino fix listed
debian 13node-undicino fix listed
debian 14node-undici8.9.0+dfsg+~cs3.2.0-1
echonode-undicino fix listed
echo npm::Echo OSVundici7.29.0
minimosghost6.67.0-r0
minimoshermes-agent2026.8.13-r0
minimoskibana-9.49.4.6-r0
minimoskibana-9.59.5.2-r0
minimoslangfuse-44.4.0-r0
minimosmcp-context74.1.3-r0
minimosn8n2.35.3-r0
minimosnode-gyp13.0.2-r0
minimosopenclaw2026.8.1-r0
minimostrigger-dev4.5.11-r1
npm::GitHub Security Advisory npmundici7.29.0, 8.9.0
rapidfort amazon linux 2023nodejsno fix listed
rapidfort amazon linux 2023nodejs20no fix listed
rapidfort amazon linux 2023nodejs241:24.18.1-1.amzn2023.0.2
rapidfort amazon linux 2023nodejs24-devel1:24.18.1-1.amzn2023.0.2
rapidfort amazon linux 2023nodejs24-docs1:24.18.1-1.amzn2023.0.2
rapidfort amazon linux 2023nodejs24-full-i18n1:24.18.1-1.amzn2023.0.2
rapidfort amazon linux 2023nodejs24-libs1:24.18.1-1.amzn2023.0.2
rapidfort amazon linux 2023nodejs24-npm1:11.16.0-1.24.18.1.1.amzn2023.0.2
rapidfort debian 12node-undici0:8.9.0+dfsg+~cs3.2.0-1
rapidfort debian 13node-undici0:8.9.0+dfsg+~cs3.2.0-1
Red Hatnodejs:26::nodejsno fix listed
Red Hatnodejs:26::nodejs-docsno fix listed
Red Hatnodejs:26::nodejs-full-i18nno fix listed
Red Hatnodejs:26::nodejs-libsno fix listed
Red Hatnodejs:26::npmno fix listed
Red Hatopenshift4/ose-monitoring-plugin-rhel9no fix listed
seal npm::Seal Security Database@seal-security/undici7.18.2-sp999, 7.19.2-sp2p2, 7.22.0-sp999
seal npm::Seal Security Databaseundici7.18.2-sp999, 7.19.2-sp2p2, 7.22.0-sp999
wolficode-server4.130.0-r5
wolfilangfuse-33.225.7-r6
wolfirenovate44.11.4-r0
wolfivitess-2424.0.3-r7

References

All 10 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.