Interpretation Conflict in undici - CVE-2026-14643
Published: July 29, 2026
Vulnerability identifier: #VU140033
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-14643
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
undici
undici
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to interpretation conflict in the cache interceptor when processing Cache-Control directives with optional whitespace around the = character. A remote attacker can send requests that cause authenticated responses to be stored and later served to another caller to disclose sensitive information.
Only applications that explicitly enable shared cache mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives are vulnerable.
How to mitigate CVE-2026-14643
Install security update from vendor's website.