Intel

CVE-2026-14643

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

highEPSS 0.3%

Description

A flaw was found in undici. The cache interceptor in undici improperly handles optional whitespace around the equals sign in `no-cache` or `private` `Cache-Control` directives. This vulnerability allows an attacker to bypass cache restrictions, leading to cross-user information disclosure. Specifically, authenticated user data can be inadvertently served from the cache to a different, potentially unauthenticated, user if both requests resolve to the same cache key.

Source: REDHAT_CSAFREDHAT_CSAFOSVCVELISTV5NVD

Metrics

Severity
high
Priority score
99.82
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.5
Source: nvd-v3
CVSS v3
5.9
CVSS v4
—
EPSS percentile
22.9 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-30 03:14 UTC
CWE
CWE-436, CWE-524

Weakness classes (CWE)

  • CWE-436Class

    Interpretation Conflict

    Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

    cwe.mitre.org →

  • CWE-524Base

    Use of Cache Containing Sensitive Information

    The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-08-04 15:53 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    • CPE Configuration: OR *cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* versions from (including) 7.0.0 up to (excluding) 7.29.0 *cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* versions from (including) 8.0.0 up to (excluding) 8.9.0
    • Reference Type: openjs: https://cna.openjsf.org/security-advisories.html Types: Third Party Advisory
    • Reference Type: openjs: https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54 Types: Mitigation, Vendor Advisory
  2. New CVE Received2026-07-29 22:16 UTC· ce714d77-add3-4f53-aff5-83d477b104bb
    • Affected: undici
    • Description: undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.
    • CVSS V3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    • CWE: CWE-436

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • bitnami

    node-min23.0.0

  • bitnami

    node-min25.0.0

  • nodejs

    undici7.0.0 – 7.29.0

  • nodejs

    undici8.0.0 – 8.9.0

  • nodejs

    undici6.28.0

  • npm

    undici7.0.0

  • npm

    undici8.0.0

  • npm

    undici

References & sources

Linked CVEs

IDCVE-2026-14643