CVE-2026-13697

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813...

SUSE CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

EUVD-2026-50567

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives...

NPM: undici vulnerable to downstream response desynchronization via retry interceptor

NPM: undici vulnerable to downstream response desynchronization via retry interceptor vulnerability discovered by ? in WordPress Npm undici versions 6.28.0...

EUVD-2026-50566

undici vulnerable to downstream response desynchronization via retry interceptor...

GHSA-8XCM-R25X-G524 undici vulnerable to downstream response desynchronization via retry interceptor

Impact Undici's interceptors.retry can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry and forward upstream response headers and bodies downstream, for...

undici vulnerable to downstream response desynchronization via retry interceptor

Impact Undici's interceptors.retry can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. Applications that use interceptors.retry and forward upstream response headers and bodies downstream, for...

GHSA-4CWX-7WF7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then serve...

EUVD-2026-50409

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives...

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then serve...

Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcfj-64vw-6mp9. This link is maintained to preserve external references. Original Description axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios...

GHSA-68JP-44VC-2X5H Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcfj-64vw-6mp9. This link is maintained to preserve external references. Original Description axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios...

openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21490-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21490-1 advisory. This update for tomcat11 fixes the following issues - Update to Tomcat 11.0.24 - CVE-2026-59083: Incorrect URL decoding in RewriteValve may allo...

SUSE CVE-2026-42294

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

SUSE-SU-2026:3430-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: Update to Tomcat 11.0.24. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...

undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length

A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...