Security vulnerabilities and automated fixes for http caching issues
1 post found
A high-severity vulnerability (CVE-2026-13697) was discovered in undici, the popular Node.js HTTP client, where malformed Cache-Control directives could lead to information disclosure and denial of service. The cache interceptor failed to properly validate the `private` directive in Cache-Control headers, potentially exposing sensitive cached data. This fix upgrades undici to versions 7.29.0 and 8.9.0 to address the parsing flaw.