CVE-2026-13697High· 7.4▾ TwilightA flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.6%
Last analysed / modified upstream
A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.
undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives — rated Important by Red Hat. Released 2026-07-29, updated 2026-10-09.
Affected:
Fixed:
No fix planned:
Not affected:
For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:76788 For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:79088 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:48537
Affected packages:
undici >= 7.0.0, < 7.29.0undici >= 8.0.0, < 8.9.0Patched in:
undici 7.29.0undici 8.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111756High· 7.5follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects (CVE-2026-111756)
CVE-2026-111755Medium· 5.9follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering (CVE-2026…
CVE-2026-69153High· 7.5postcss: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
CVE-2026-111757Medium· 5.3hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic (CVE-2026-111757)
CVE-2026-116190Low· 3.7github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects (CVE-2026-116190)
CVE-2026-115754Medium· 4.7serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization (CVE-2026-115754)