CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.

• CWE-436
• CWE-524

• https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54Mitigation, Vendor Advisory

Published

Jul 29, 2026

Last Modified

Aug 4, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14638A flaw has been found in itsourcecode Hospital Management Sy…6.3
• CVE-2026-14639A vulnerability has been found in CodeAstro Ecommerce Websit…6.3
• CVE-2026-1464Integer Overflow or Wraparound vulnerability in MuntashirAko…4.6
• CVE-2026-14640A vulnerability was found in CodeAstro Apartment Visitor Man…7.3
• CVE-2026-14641A vulnerability was determined in SourceCodester Class and E…7.3
• CVE-2026-14642A vulnerability was identified in SourceCodester Class and E…7.3
• CVE-2026-14644Nexus Repository 3 contained a privilege escalation vulnerab…8.6
• CVE-2026-14645Nexus Repository 3 does not validate the destination of the …5.1
• CVE-2026-14646Nexus Repository 3 did not apply its existing Server-Side Re…4.9
• CVE-2026-14647A weakness has been identified in onnx up to 1.21.x. This vu…4.3
• CVE-2026-14648A security vulnerability has been detected in code-projects …7.3
• CVE-2026-14649A vulnerability was detected in code-projects Online Voting …7.3