---
id: CVE-2026-13697
title: >-
  undici: undici: Information disclosure and Denial of Service via malformed
  Cache-Control directives (CVE-2026-13697)
summary: >-
  A flaw was found in undici. This vulnerability allows for cross-user
  information disclosure when malformed Cache-Control private directives cause
  private response bodies and headers, such as Set-Cookie data, to be stored in
  a shared cache …
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-524
  - CWE-200
  - CWE-248
  - CWE-525
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - build_of_podman_desktop
  - enterprise_linux 10
  - enterprise_linux 9
  - hardened_images
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - openshift_dev_spaces
  - secrets_management_console_for_red_hat_openshift
  - self_service_automation_portal 2
  - developer_hub 1.10
patched:
  - developer_hub 1.10
  - hardened_images
published: '2026-07-29'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T23:10:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13697.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13697.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-13697'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2508485'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-13697'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13697'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76788'
  - url: 'https://access.redhat.com/errata/RHSA-2026:79088'
  - url: 'https://access.redhat.com/errata/RHSA-2026:48537'
  - url: 'https://access.redhat.com/errata/RHSA-2026:48273'
  - url: >-
      https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451
  - url: 'https://github.com/nodejs/undici/releases/tag/v7.29.0'
  - url: 'https://github.com/nodejs/undici/releases/tag/v8.9.0'
  - url: 'https://github.com/advisories/GHSA-4cwx-7wf7-3272'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00569
epssPercentile: 0.46948
aliases:
  - GHSA-4cwx-7wf7-3272
ecosystem: npm
ingestedAt: '2026-08-03T19:29:00.316Z'
---

## Overview

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.

## Vendor advisories

- **RHSA-2026:76788** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76788)
- **RHSA-2026:79088** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79088)
- **RHSA-2026:48537** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48537)
- **RHSA-2026:48273** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48273)
- **Red Hat VEX** · Important · affected: Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Build of Podman Desktop, Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13697.json)

**undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives** — rated Important by Red Hat. Released 2026-07-29, updated 2026-10-09.

Affected:

- Red Hat Build of Podman Desktop
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Secrets Management Console for Red Hat OpenShift
- Self-service automation portal 2

Fixed:

- Red Hat Developer Hub 1.10
- Red Hat Hardened Images

No fix planned:

- Red Hat Build of Podman Desktop
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Secrets Management Console for Red Hat OpenShift
- Self-service automation portal 2

Not affected:

- Red Hat Developer Hub 1.10
- Red Hat Hardened Images
- Cryostat 4
- Exploit Intelligence
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Podman Desktop
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8

## Remediation

For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:76788
For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:79088
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:48537

## Package advisory (CVE-2026-13697)

Affected packages:

- `undici >= 7.0.0, < 7.29.0`
- `undici >= 8.0.0, < 8.9.0`

Patched in:

- `undici 7.29.0`
- `undici 8.9.0`

Source: https://github.com/advisories/GHSA-4cwx-7wf7-3272