{"vulnerability": "cve-2026-1464", "sightings": [{"uuid": "581a1ae5-3fe7-429a-b80c-395d0a06b5c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14643", "type": "seen", "source": "https://gist.github.com/alon710/dbd628dcf4d2ee2986aea22ad7d6f2b4", "content": "# CVE-2026-14643: CVE-2026-14643: Shared Cache Pollution and Information Disclosure via Whitespace Parsing Discrepancies in Undici\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-14643\n\n## Summary\nAn interpretation conflict (CWE-436) in the cache interceptor of the undici HTTP client for Node.js causes whitespace-padded Cache-Control directives to be parsed incorrectly, leading to shared cache pollution and the unauthorized disclosure of sensitive, private, or authenticated user information (CWE-524).\n\n## TL;DR\nAn interpretation conflict in undici's cache parser fails to strip whitespace from Cache-Control directives, leading to unauthorized sharing of private cached data.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-436 / CWE-524\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00229\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing Node.js undici client with Cache Interceptor enabled in shared mode\n- **undici**: >= 7.0.0 < 7.29.0 (Fixed in: `7.29.0`)\n- **undici**: >= 8.0.0 < 8.9.0 (Fixed in: `8.9.0`)\n\n## Mitigation\n\n- Upgrade undici to 7.29.0 or 8.9.0 or higher\n- Normalize Cache-Control headers at reverse proxy/CDN level\n- Disable shared cache configuration within undici Cache Interceptor\n\n**Remediation Steps:**\n1. Audit local lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to identify nested instances of undici below 7.29.0 or 8.9.0\n2. Run dependency updates to pull secure packages ('npm update undici' or 'yarn upgrade undici')\n3. Verify that no response header transformations introduce arbitrary whitespaces near Cache-Control directives\n4. Enforce end-to-end integration testing using a verification script to validate that 'private=\" authorization\"' headers effectively block public caching\n\n## References\n\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-14643)\n- [GitHub Security Advisory GHSA-jr45-8vmc-qm54](https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54)\n- [OpenJSF Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [CVE-2026-14643 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-14643)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-14643) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T12:31:53.545675Z"}, {"uuid": "14a97106-771a-4b71-8ba5-639796a089e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14649", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpubk4qgkr2h", "content": "CVE-2026-14649 - code-projects Online Voting System saveVote.php test_input sql injection\nCVE ID : CVE-2026-14649\n \n Published : 4 juillet 2026 19:45 | 2\u00a0heures, 30\u00a0minutes ago\n \n Description : A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is...", "creation_timestamp": "2026-07-05T00:02:38.477479Z"}, {"uuid": "1f353793-ccfd-4ec4-a56f-dfeb0a1e4445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14648", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpubwlkocb2t", "content": "CVE-2026-14648 - code-projects Online Voting System Login authentication.php test_input sql injection\nCVE ID : CVE-2026-14648\n \n Published : 4 juillet 2026 19:15 | 3\u00a0heures ago\n \n Description : A security vulnerability has been detected in code-projects Online Voting System up...", "creation_timestamp": "2026-07-05T00:09:36.888698Z"}, {"uuid": "fdcff4c8-e32c-4b63-9e46-f94fcf420f89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpucnk2xtv2d", "content": "CVE-2026-14647 - onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds\nCVE ID : CVE-2026-14647\n \n Published : 4 juillet 2026 19:16 | 2\u00a0heures, 58\u00a0minutes ago\n \n Description : A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the fun...", "creation_timestamp": "2026-07-05T00:22:26.704012Z"}, {"uuid": "159dd577-3b83-4e76-828e-5c64e9579461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14640", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpucv7n22t2k", "content": "CVE-2026-14640 - CodeAstro Apartment Visitor Management System Login index.php sql injection\nCVE ID : CVE-2026-14640\n \n Published : 4 juillet 2026 19:16 | 2\u00a0heures, 58\u00a0minutes ago\n \n Description : A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. ...", "creation_timestamp": "2026-07-05T00:26:46.620575Z"}, {"uuid": "d52c3cdd-89aa-439d-8989-1b4d43b2042c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14641", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpudh4j6re2d", "content": "CVE-2026-14641 - SourceCodester Class and Exam Timetabling System edit_course.php sql injection\nCVE ID : CVE-2026-14641\n \n Published : 4 juillet 2026 19:16 | 2\u00a0heures, 58\u00a0minutes ago\n \n Description : A vulnerability was determined in SourceCodester Class and Exam Timetabling S...", "creation_timestamp": "2026-07-05T00:36:46.746130Z"}, {"uuid": "ea7121b5-fa5b-490c-9ac3-d7588998153b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14642", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpudq2wjvl2m", "content": "CVE-2026-14642 - SourceCodester Class and Exam Timetabling System edit_class2.php sql injection\nCVE ID : CVE-2026-14642\n \n Published : 4 juillet 2026 19:16 | 2\u00a0heures, 58\u00a0minutes ago\n \n Description : A vulnerability was identified in SourceCodester Class and Exam Timetabling S...", "creation_timestamp": "2026-07-05T00:41:45.576596Z"}, {"uuid": "fa0ef6b8-9b34-4ded-b3b0-a81eb573b31f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq26wergmy2d", "content": "CVE-2026-14647: ONNX Runtime's Out-of-Bounds Access Exposes Risk #CVE2026 #ONNXRuntime #CyberSecurity", "creation_timestamp": "2026-07-07T08:31:47.210928Z"}, {"uuid": "7d5dcf5a-8852-4054-8382-06ef79b64172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq26wiuqfo2o", "content": "CVE-2026-14647: Onnxruntime's Out-of-Bounds Vulnerability Signals Attackers #CVE2026 #Onnxruntime #CyberSecurity", "creation_timestamp": "2026-07-07T08:31:52.470747Z"}, {"uuid": "427c1385-c4fa-4242-ba1e-713cbbf56b64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq26wmwf7q2d", "content": "CVE-2026-14647: ONNX Runtime Vulnerability Raises Questions About User Safety #CVE202614647 #ONNXRuntime #CyberSecurity", "creation_timestamp": "2026-07-07T08:31:56.648675Z"}, {"uuid": "ba49e45f-26ab-483c-8d5c-f896d5c92aaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq26wqk3o42k", "content": "CVE-2026-14647: ONNX Runtime's Out-of-Bounds Access Demands Accountability #CVE2026 #ONNXRuntime #Cybersecurity", "creation_timestamp": "2026-07-07T08:32:00.115161Z"}, {"uuid": "11c03b24-2da6-4fda-97ce-e831f9fc72d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq272v47pm2k", "content": "CVE-2026-14647: onnxruntime's Unaddressed Out-of-Bounds Access Raises Concerns #CVE2026 #SecurityVulnerability #Onnxruntime", "creation_timestamp": "2026-07-07T08:34:18.605313Z"}, {"uuid": "b65ad5d9-8b89-4f67-9cf4-a7a7df88d7fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq272yuvze2k", "content": "CVE-2026-14647: Is the ONNX Runtime Vulnerability a Serious Threat or a False Alarm? #CVE2026 #ONNXRuntime #CyberSecurity", "creation_timestamp": "2026-07-07T08:34:22.393359Z"}, {"uuid": "4e6290d5-7928-411b-89d9-64a01de56814", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14647", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mq272zqwzp2l", "content": "CVE-2026-14647: Is the ONNX Runtime Vulnerability a Serious Threat or a False Alarm? #CVE2026 #ONNXRuntime #PotatoSecurity", "creation_timestamp": "2026-07-07T08:34:24.095534Z"}, {"uuid": "0053bc0d-acba-4e46-9c71-3367cc45ac63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-14643", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mrstmoc6mc2c", "content": "\ud83d\udea8 Medium-severity security fix in undici@7.29.0 and undici@8.9.0 just released!\n\nPatches CVE-2026-14643: cross-user disclosure via whitespace around equals in Cache-Control directives\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-07-29T21:11:16.945958Z"}]}