CVE-2026-13697: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Vulnerability summary

CVE-2026-13697 is a critical (CVSS 9.1) vulnerability in nodejs undici. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities.

Timeline

1. 29-07-2026
   PublishedVulnerability first disclosed.
2. 29-07-2026
   Last modifiedVulnerability information updated.

Description

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught.
• CWE-525Use of Web Browser Cache Containing Sensitive InformationThe web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.