--- id: CVE-2026-9678 title: >- undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) summary: >- A flaw was found in Undici. The cache interceptor in shared-cache mode incorrectly classifies certain responses as cacheable due to improper handling of whitespace-padded Cache-Control header field names. This vulnerability allows an unaut… severity: medium cvss: 5.9 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N' cvssSource: vendor cwe: - CWE-1286 - CWE-524 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 8) affected: - cryostat 4 - openshift_pipelines - amq_broker 7 - build_of_podman_desktop - developer_hub - enterprise_linux 8 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_dev_spaces - self_service_automation_portal 2 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_v_9 - hardened_images patched: - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_v_9 - hardened_images published: '2026-06-17' updated: '2026-10-01' sourceUpdated: '2026-10-01T17:20:00+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9678.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9678.json - url: 'https://access.redhat.com/security/cve/CVE-2026-9678' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490000' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-9678' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9678' - url: 'https://cna.openjsf.org/security-advisories.html' - url: 'https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6' - url: 'https://access.redhat.com/errata/RHSA-2026:35842' - url: 'https://access.redhat.com/errata/RHSA-2026:35841' - url: 'https://access.redhat.com/errata/RHSA-2026:41947' - url: 'https://access.redhat.com/errata/RHSA-2026:39868' - url: 'https://access.redhat.com/errata/RHSA-2026:35892' - url: 'https://access.redhat.com/errata/RHSA-2026:35891' - url: 'https://access.redhat.com/errata/RHSA-2026:38236' - url: 'https://access.redhat.com/errata/RHSA-2026:7378' - url: 'https://access.redhat.com/errata/RHSA-2026:22380' - url: 'https://github.com/advisories/GHSA-pr7r-676h-xcf6' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.00388 epssPercentile: 0.32776 ecosystem: npm ingestedAt: '2026-06-19T03:39:00.823Z' --- ## Overview A flaw was found in Undici. The cache interceptor in shared-cache mode incorrectly classifies certain responses as cacheable due to improper handling of whitespace-padded Cache-Control header field names. This vulnerability allows an unauthenticated attacker to access authenticated user data from the cache, leading to information disclosure. This occurs when both authenticated and unauthenticated requests resolve to the same cache key. ## Vendor advisories - **RHSA-2026:35842** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35842) - **RHSA-2026:35841** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35841) - **RHSA-2026:41947** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41947) - **RHSA-2026:39868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:39868) - **RHSA-2026:35892** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35892) - **RHSA-2026:35891** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35891) - **RHSA-2026:38236** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:38236) - **RHSA-2026:7378** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7378) - **RHSA-2026:22380** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22380) - **Red Hat VEX** · Moderate · affected: Cryostat 4, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Build of Podman Desktop, Red Hat Developer Hub, Red Hat Enterprise Linux 8, … · no fix planned: Cryostat 4, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Build of Podman Desktop, … · updated 2026-10-01 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9678.json) **undici: Undici: Information disclosure due to improper cache-control header parsing** — rated Moderate by Red Hat. Released 2026-06-17, updated 2026-10-01. Affected: - Cryostat 4 - OpenShift Pipelines - Red Hat AMQ Broker 7 - Red Hat Build of Podman Desktop - Red Hat Developer Hub - Red Hat Enterprise Linux 8 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Dev Spaces - Self-service automation portal 2 Fixed: - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream (v. 9) - Red Hat Hardened Images No fix planned: - Cryostat 4 - OpenShift Pipelines - Red Hat AMQ Broker 7 - Red Hat Build of Podman Desktop - Red Hat Developer Hub - Red Hat Enterprise Linux 8 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Dev Spaces - Self-service automation portal 2 Not affected: - Red Hat Hardened Images - Red Hat OpenShift AI (RHOAI) ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:35842 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:35841 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:41947 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2026-9678) Affected packages: - `undici >= 7.0.0, < 7.28.0` - `undici >= 8.0.0, < 8.5.0` Patched in: - `undici 7.28.0` - `undici 8.5.0` Source: https://github.com/advisories/GHSA-pr7r-676h-xcf6