You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js:
Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.
Parse-time crash: Mixed unqualified-and-qualified private directives in the same header (such as public, max-age=60, private, private="hdr") cause an uncaught TypeError in the cache-control parser, terminating the request.
Impact
Shared-cache disclosure
Applications using interceptors.cache() in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including Set-Cookie.
Required conditions:
the cache interceptor is enabled in shared mode, including the default configuration;
an upstream returns a malformed directive such as Cache-Control: public, max-age=300, private="";
another request later matches the same cache key, without a separating Vary header.
Parse-time crash
Applications using interceptors.cache() against an upstream that returns a Cache-Control header combining unqualified private with qualified private="..." see an uncaught TypeError: output.private.concat is not a function during response handling. The request rejects; depending on the consumer's error handling, the process may exit.
Details
private="" is parsed as { private: [''] }. The shared-cache guard only rejects private === true, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.
For the crash variant, an unqualified private directive sets output.private = true, then a subsequent qualified private="hdr" directive attempts output.private.concat(['hdr']), which throws because boolean has no concat method.
The patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to true and preserves existing true values, closing both vectors.
Patches
Upgrade to undici 7.29.0 or 8.9.0. Both releases fix the qualified private directive handling that caused the shared-cache storage and the parser crash.
Workarounds
Until patched, avoid shared interceptors.cache() for user-specific responses, use type: 'private', or disable caching for affected origins.
Credit
Disclosure variant reported by @h0rk1p via HackerOne report #3817497.
Undici's interceptors.retry() can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry() and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a stale Content-Length header. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata.
A malicious or faulty upstream can respond to a range request with a 206 Partial Content response such as:
Content-Range: bytes 0-99/300Content-Length: 300
and then send only 99 bytes before closing the socket. interceptors.retry() can then retry with Range: bytes=99-99, receive the final byte, and deliver a 100-byte body to the application while the response headers still contain Content-Length: 300 from the first response.
The bug requires interceptors.retry() to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculate Content-Length.
Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
Workarounds
Disable interceptors.retry() for untrusted upstreams.
Remove or recalculate Content-Length before forwarding a response body assembled or transformed by Undici.
The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.
Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.
Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0.
Workarounds
Sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie.
Do not pass user-controlled data to the unparsed field.
Undici's cache interceptor mishandles optional whitespace (OWS) placed around the = of a qualified no-cache or private Cache-Control directive, such as no-cache ="authorization" (OWS before =) or no-cache= "authorization" (OWS after =). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.
In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-= bypass that the earlier fix did not normalize.
Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives whose field-name list is padded with OWS around the =.
Patches
Upgrade to undici v7.29.0 or v8.9.0.
Workarounds
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via request(), stream(), pipeline(), or dispatch()) with a .type derived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.
The vulnerable branch in lib/dispatcher/client-h1.js pushes body.type directly into the outgoing headers with no validation, while every other header path in undici goes through isValidHeaderValue():
The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled .type. Native Blob is safe because its constructor strips CRLF from .type. fetch() is unaffected because it validates via the Headers class. Ecosystem consumers that build duck-typed blob shapes from user input include form-data-encoder, formdata-polyfill, and formdata-node.
Same defect class as CVE-2022-35948 (explicit content-type sink, fixed in undici 5.8.2) and CVE-2026-1527 (upgrade option sink, fixed in 6.24.0 / 7.24.0), both closed by adding isValidHeaderValue() on their respective sinks. This branch was missed.
Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
Workarounds
Set an explicit, validated content-type header on the request options (skips the vulnerable branch).
Use a native Blob (or fetch-blob) instead of a hand-rolled duck-typed object.
Reject control characters in the MIME type before assigning it to .type.
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer TIP This summary will be updated as you push new changes.
There hasn't been any activity on this pull request recently. Therefore, this pull request has been automatically marked as stale and will be closed if no further activity occurs within seven days. Thank you for your contributions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.6.0→8.9.0undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
CVE-2026-13697 / GHSA-4cwx-7wf7-3272
More information
Details
Summary
Two issues in undici's cache interceptor, both fixed by the same patch on
lib/util/cache.js:Cache-Control: privatedirectives such asprivate=""orprivate=","can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key.privatedirectives in the same header (such aspublic, max-age=60, private, private="hdr") cause an uncaughtTypeErrorin the cache-control parser, terminating the request.Impact
Shared-cache disclosure
Applications using
interceptors.cache()in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, includingSet-Cookie.Required conditions:
Cache-Control: public, max-age=300, private="";Varyheader.Parse-time crash
Applications using
interceptors.cache()against an upstream that returns aCache-Controlheader combining unqualifiedprivatewith qualifiedprivate="..."see an uncaughtTypeError: output.private.concat is not a functionduring response handling. The request rejects; depending on the consumer's error handling, the process may exit.Details
private=""is parsed as{ private: [''] }. The shared-cache guard only rejectsprivate === true, so the response can be stored. When served from cache, the previous user's body and headers may be returned to a different user.For the crash variant, an unqualified
privatedirective setsoutput.private = true, then a subsequent qualifiedprivate="hdr"directive attemptsoutput.private.concat(['hdr']), which throws because boolean has noconcatmethod.The patch routes the qualified-directive path through a shared helper that normalizes empty-after-trim arrays to
trueand preserves existingtruevalues, closing both vectors.Patches
Upgrade to
undici7.29.0 or 8.9.0. Both releases fix the qualifiedprivatedirective handling that caused the shared-cache storage and the parser crash.Workarounds
Until patched, avoid shared
interceptors.cache()for user-specific responses, usetype: 'private', or disable caching for affected origins.Credit
Disclosure variant reported by @h0rk1p via HackerOne report #3817497.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-16728 / GHSA-8xcm-r25x-g524
More information
Details
Impact
Undici's
interceptors.retry()can deliver a response whose body length does not match theContent-Lengthheader exposed to the application after a retry or resume of a partial response. Applications that useinterceptors.retry()and forward upstream response headers and bodies downstream, for example proxy or gateway applications, may emit an invalid HTTP response with a staleContent-Lengthheader. This can lead to downstream response desynchronization, connection hangs, or response corruption in clients or intermediaries that rely on the forwarded framing metadata.A malicious or faulty upstream can respond to a range request with a
206 Partial Contentresponse such as:and then send only 99 bytes before closing the socket.
interceptors.retry()can then retry withRange: bytes=99-99, receive the final byte, and deliver a 100-byte body to the application while the response headers still containContent-Length: 300from the first response.The bug requires
interceptors.retry()to be enabled, an upstream that returns a partial response with a mismatched framing header, and a downstream forwarder that does not remove or recalculateContent-Length.Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
Workarounds
interceptors.retry()for untrusted upstreams.Content-Lengthbefore forwarding a response body assembled or transformed by Undici.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729 / GHSA-v3r7-h72x-cjcm
More information
Details
Impact
The
setCookiefunction has two attribute injection paths.validateCookieDomaindoes not reject semicolons (validateCookiePathalready does at 0x3B), so adomainvalue likeexample.com; SameSite=Nonelands verbatim asDomain=example.com; SameSite=None. Theunparsedarray's loop only checks each entry contains=and does not sanitize values, so an entry likeX-Custom=val; HttpOnlylands unchanged, injectingHttpOnlywithout the caller settingcookie.httpOnly = true.Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed,
SecureorHttpOnlyforced or stripped, or the intended SameSite tier overridden.Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0.
Workarounds
domainvalues against the RFC 1034 letter-digit-hyphen set before passing tosetCookie.unparsedfield.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
CVE-2026-14643 / GHSA-jr45-8vmc-qm54
More information
Details
Impact
Undici's cache interceptor mishandles optional whitespace (OWS) placed around the
=of a qualifiedno-cacheorprivateCache-Control directive, such asno-cache ="authorization"(OWS before=) orno-cache= "authorization"(OWS after=). The parser either drops the directive entirely or stores a field name with literal quote characters, so the downstream cache decisions do not recognize the qualification and the response is stored.In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. The impact class is identical to CVE-2026-9678 (GHSA-pr7r-676h-xcf6); this advisory covers the whitespace-around-
=bypass that the earlier fix did not normalize.Affected applications are those that explicitly enable the cache interceptor (
interceptors.cache()) in shared mode, forwardAuthorizationheaders upstream, and receive cacheable responses with qualifiedprivateorno-cachedirectives whose field-name list is padded with OWS around the=.Patches
Upgrade to undici v7.29.0 or v8.9.0.
Workarounds
If upgrade is not immediately possible, disable shared-cache mode for traffic that includes
Authorizationheaders, avoid caching responses to authenticated requests, or addVary: Authorizationupstream.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-15157 / GHSA-m8rv-5g2x-5cg5
More information
Details
Impact
When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via
request(),stream(),pipeline(), ordispatch()) with a.typederived from untrusted input, an attacker can inject CRLF sequences (\r\n) to append arbitrary HTTP headers and potentially smuggle a second request past the upstream.The vulnerable branch in
lib/dispatcher/client-h1.jspushesbody.typedirectly into the outgoing headers with no validation, while every other header path in undici goes throughisValidHeaderValue():The bug requires a hand-rolled duck-typed blob object or a Blob subclass with a controlled
.type. NativeBlobis safe because its constructor strips CRLF from.type.fetch()is unaffected because it validates via theHeadersclass. Ecosystem consumers that build duck-typed blob shapes from user input includeform-data-encoder,formdata-polyfill, andformdata-node.Same defect class as
CVE-2022-35948(explicitcontent-typesink, fixed in undici 5.8.2) andCVE-2026-1527(upgradeoption sink, fixed in 6.24.0 / 7.24.0), both closed by addingisValidHeaderValue()on their respective sinks. This branch was missed.Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0. Users should upgrade to one of these versions or later.
Workarounds
content-typeheader on the request options (skips the vulnerable branch).Blob(orfetch-blob) instead of a hand-rolled duck-typed object..type.fetch()instead of the non-fetchAPIs.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
nodejs/undici (undici@7)
v8.9.0Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.8.0...v8.9.0
v8.8.0Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.7.0...v8.8.0
v8.7.0Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.6.0...v8.7.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.