Security vulnerabilities and automated fixes for cve 2026 13697 issues
2 posts found
A critical vulnerability (CVE-2026-13697) was discovered in the undici HTTP client library, allowing attackers to exploit malformed Cache-Control directives for information disclosure and denial of service. This fix upgrades undici from version 7.25.0 to 7.29.0 using npm overrides to ensure all nested dependencies receive the patched version.
CVE-2026-13697 is a high-severity vulnerability in undici, the popular Node.js HTTP client, where the cache interceptor fails to properly validate malformed `Cache-Control: private` directives. This could allow sensitive cached responses to be served to unauthorized users. The fix upgrades undici from 7.28.0 to 7.29.0 (and 6.27.0 to 6.28.0) across the dependency tree, including using npm overrides to patch transitive dependencies.