CVE-2026-13697

설명

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which reje...

영향 제품·버전

제품 undici

영향 버전 undici >= 7.0.0 < 7.29.0, >= 8.0.0 < 8.9.0

수정 버전 undici · 수정 버전은 공급사 공식자료 확인 필요

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

CWE CWE-200, CWE-248, CWE-525