Node.js Module Undici 7.x < 7.29.0 / 8.x < 8.9.0 Information Disclosure

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333340);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/07");

  script_cve_id("CVE-2026-13697");
  script_xref(name:"IAVB", value:"2026-B-0220");

  script_name(english:"Node.js Module Undici 7.x < 7.29.0 / 8.x < 8.9.0 Information Disclosure");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The nodejs module Undici detected on the host is version 7.x prior to 7.29.0 or 8.x prior to 8.9.0. It is, therefore,
affected by a vulnerability:

  - undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to
    before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive,
    such as private set to an empty value, can be stored in the default shared cache and later served to a
    different caller with the same cache key, disclosing private response bodies and headers including
    Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a
    qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and,
    depending on the consumer's error handling, can terminate the process. Both issues affect applications
    using the cache interceptor in shared mode, including the default configuration. The issues are fixed in
    undici 7.29.0 and 8.9.0. (CVE-2026-13697)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5f87ea53");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Undici version 7.29.0 / 8.9.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13697");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:undici:undici");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("installed_sw/Node.js", "Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'undici');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'undici');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version': '7.0.0', 'fixed_version': '7.29.0'},
  {'min_version': '8.0.0', 'fixed_version': '8.9.0'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);