CVE-2026-14643
CVE-2026-14643 is a medium-severity vulnerability in Nodejs Undici with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-436.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- EPSS exploit prediction: 0% (14th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-436
- Affected product: Nodejs Undici
- Published:
- Last modified:
Description
undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.
Frequently asked questions
- What is CVE-2026-14643?
- undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters, so the cache decision fails to recognize the qualification and the response is stored. In shared-cache mode, this lets a response containing one user's authenticated data be served from cache to a later caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and receive cacheable responses with qualified directives padded with whitespace around the equals sign. This is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed in undici 7.29.0 and 8.9.0.
- How severe is CVE-2026-14643?
- CVE-2026-14643 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-14643 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-14643?
- CVE-2026-14643 affects Nodejs Undici. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-14643?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-14643 published?
- CVE-2026-14643 was published on 2026-07-29 and last updated on 2026-08-04.
References
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54
Affected products (1)
- cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
More vulnerabilities in Nodejs Undici
- CVE-2026-6734 — High (CVSS 7.5): Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying…
- CVE-2026-9675 — High (CVSS 7.5): Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of…
- CVE-2026-12151 — High (CVSS 7.5): Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but…
- CVE-2026-2229 — High (CVSS 7.5): ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of…
- CVE-2026-1528 — High (CVSS 7.5): ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's…
- CVE-2026-1526 — High (CVSS 7.5): The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during…
All CVEs affecting Nodejs Undici →
Other CWE-436 vulnerabilities
- CVE-2023-24813 — Critical (CVSS 10.0): Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and…
- CVE-2026-63030 — Critical (CVSS 9.8): WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue…
- CVE-2026-47767 — Critical (CVSS 9.8): Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until…
- CVE-2026-8034 — Critical (CVSS 9.8): A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that…
- CVE-2021-45327 — Critical (CVSS 9.8): Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable…
- CVE-2020-10180 — Critical (CVSS 9.8): The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects…