EUVD-2026-50409

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives...

GHSA-4CWX-7WF7-3272 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly stored in the default shared cache, then serve...