{"uuid": "5130effa-c2b9-42e9-a8fa-f0e6f841124b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jr45-8vmc-qm54", "type": "seen", "source": "https://gist.github.com/alon710/dbd628dcf4d2ee2986aea22ad7d6f2b4", "content": "# CVE-2026-14643: CVE-2026-14643: Shared Cache Pollution and Information Disclosure via Whitespace Parsing Discrepancies in Undici\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-14643\n\n## Summary\nAn interpretation conflict (CWE-436) in the cache interceptor of the undici HTTP client for Node.js causes whitespace-padded Cache-Control directives to be parsed incorrectly, leading to shared cache pollution and the unauthorized disclosure of sensitive, private, or authenticated user information (CWE-524).\n\n## TL;DR\nAn interpretation conflict in undici's cache parser fails to strip whitespace from Cache-Control directives, leading to unauthorized sharing of private cached data.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436 / CWE-524\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00229\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing Node.js undici client with Cache Interceptor enabled in shared mode\n- **undici**: >= 7.0.0 < 7.29.0 (Fixed in: `7.29.0`)\n- **undici**: >= 8.0.0 < 8.9.0 (Fixed in: `8.9.0`)\n\n## Mitigation\n\n- Upgrade undici to 7.29.0 or 8.9.0 or higher\n- Normalize Cache-Control headers at reverse proxy/CDN level\n- Disable shared cache configuration within undici Cache Interceptor\n\n**Remediation Steps:**\n1. Audit local lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to identify nested instances of undici below 7.29.0 or 8.9.0\n2. Run dependency updates to pull secure packages ('npm update undici' or 'yarn upgrade undici')\n3. Verify that no response header transformations introduce arbitrary whitespaces near Cache-Control directives\n4. Enforce end-to-end integration testing using a verification script to validate that 'private=\" authorization\"' headers effectively block public caching\n\n## References\n\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-14643)\n- [GitHub Security Advisory GHSA-jr45-8vmc-qm54](https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54)\n- [OpenJSF Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [CVE-2026-14643 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-14643)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-14643) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T12:31:53.607869Z"}