CyberRota Analysis
AI-GeneratedThe vulnerability affects the undici cache interceptor in versions 7.0.0 to 7.28.0 and 8.0.0 to 8.8.0, allowing malformed Cache-Control private directives to be mishandled. This can lead to private response bodies and headers, including sensitive Set-Cookie data, being improperly cached and served to unauthorized users, as well as potential process termination due to uncaught TypeErrors. Organizations utilizing undici in shared cache mode should prioritize updating to versions 7.29.0 or 8.9.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)