CVE-2026-14643: CVE-2026-14643: Shared Cache Pollution and Information Disclosure via Whitespace Parsing Discrepancies in Undici

CVE-2026-14643: Shared Cache Pollution and Information Disclosure via Whitespace Parsing Discrepancies in Undici

Vulnerability ID: CVE-2026-14643
CVSS Score: 5.9
Published: 2026-08-03

An interpretation conflict (CWE-436) in the cache interceptor of the undici HTTP client for Node.js causes whitespace-padded Cache-Control directives to be parsed incorrectly, leading to shared cache pollution and the unauthorized disclosure of sensitive, private, or authenticated user information (CWE-524).

TL;DR

An interpretation conflict in undici's cache parser fails to strip whitespace from Cache-Control directives, leading to unauthorized sharing of private cached data.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-436 / CWE-524
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 5.9 (Medium)
• EPSS Score: 0.00229
• Impact: Confidentiality (High)
• Exploit Status: Proof-of-Concept (PoC)
• KEV Status: Not Listed

Affected Systems

• Applications utilizing Node.js undici client with Cache Interceptor enabled in shared mode
• undici: >= 7.0.0 < 7.29.0 (Fixed in: 7.29.0)
• undici: >= 8.0.0 < 8.9.0 (Fixed in: 8.9.0)

Code Analysis

Commit: 85a2405

Fix: whitespace trimming in qualified no-cache / private directives parser

@@ -228,6 +228,10 @@ function parseCacheControlHeader (header) {
                 headers[headers.length - 1] = lastHeader
               }

+              for (let j = 0; j < headers.length; j++) {
+                headers[j] = headers[j].trim()
+              }
+
               if (key in output) {
                 output[key] = output[key].concat(headers)
               } else {
@@ -236,10 +240,12 @@ function parseCacheControlHeader (header) {
             }
           } else {
             // Something like `no-cache="some-header"`
+            const fieldName = value.trim()
+
             if (key in output) {
-              output[key] = output[key].concat(value)
+              output[key] = output[key].concat(fieldName)
             } else {
-              output[key] = [value]
+              output[key] = [fieldName]
             }
           }

Commit: cb105d7

Cherry-pick fix to v8.x branch

Exploit Details

• Unit Test in Commit 85a240551c9feb8b8a0ecc56c84b2b3015add8a9: Unit tests validating correct behavior of whitespace trimmed fields inside the Cache-Control parsing utility

Mitigation Strategies

• Upgrade undici to 7.29.0 or 8.9.0 or higher
• Normalize Cache-Control headers at reverse proxy/CDN level
• Disable shared cache configuration within undici Cache Interceptor

Remediation Steps:

1. Audit local lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to identify nested instances of undici below 7.29.0 or 8.9.0
2. Run dependency updates to pull secure packages ('npm update undici' or 'yarn upgrade undici')
3. Verify that no response header transformations introduce arbitrary whitespaces near Cache-Control directives
4. Enforce end-to-end integration testing using a verification script to validate that 'private=" authorization"' headers effectively block public caching

References

• NVD Vulnerability Details
• GitHub Security Advisory GHSA-jr45-8vmc-qm54
• OpenJSF Security Advisories
• CVE-2026-14643 on CVE.org

---

Read the full report for CVE-2026-14643 on our website for more details including interactive diagrams and full exploit analysis.