Source: node-undici Version: 8.5.0+dfsg+~cs3.2.0-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for node-undici. CVE-2026-13697[0]: | undici's cache interceptor mishandles malformed Cache-Control | private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up | to before 8.9.0, a response carrying a degenerate qualified private | directive, such as private set to an empty value, can be stored in | the default shared cache and later served to a different caller with | the same cache key, disclosing private response bodies and headers | including Set-Cookie. Separately, a Cache-Control header that | combines an unqualified private directive with a qualified one | triggers an uncaught TypeError in the cache-control parser, which | rejects the request and, depending on the consumer's error handling, | can terminate the process. Both issues affect applications using the | cache interceptor in shared mode, including the default | configuration. The issues are fixed in undici 7.29.0 and 8.9.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-13697 https://www.cve.org/CVERecord?id=CVE-2026-13697 [1] https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
