How Cache-Control Header Parsing Vulnerabilities Happen in Node.js HTTP Clients and How to Fix Them

Introduction

The package-lock.json file in this repository declared undici as a dependency—a high-performance HTTP/1.1 client that powers many Node.js applications' networking capabilities. However, a critical flaw lurked in undici's cache interceptor: when processing Cache-Control headers containing malformed private directives, the parser failed to properly reject or handle the invalid input.

This vulnerability, tracked as CVE-2026-13697, meant that an attacker could craft HTTP responses with specially malformed Cache-Control headers to either extract information from the cache that should have remained private, or trigger a denial of service condition. For applications using undici's caching features to improve performance, this created an unexpected attack surface where the very mechanism designed to optimize responses became a liability.

The Vulnerability Explained

What Went Wrong in Undici's Cache Interceptor

HTTP caching relies heavily on the Cache-Control header to determine how responses should be stored and served. The private directive specifically indicates that a response is intended for a single user and must not be stored by shared caches. When this directive is malformed—perhaps through extra characters, improper quoting, or unexpected formatting—a robust parser should either reject the header entirely or fail safely.

Undici's cache interceptor, prior to versions 7.29.0 and 8.9.0, did not properly handle these edge cases. The malformed private directive parsing could result in:

1. Information Disclosure: Responses marked as private might be incorrectly cached and served to other users
2. Denial of Service: Malformed headers could cause parsing errors that disrupt normal cache operations

Attack Scenario

Consider an application using undici to fetch user-specific data from an API:

import { request, cacheInterceptor } from 'undici';

const client = new Client('https://api.example.com', {
  interceptors: [cacheInterceptor()]
});

// Fetch user-specific dashboard data
const response = await client.request({
  path: '/api/user/dashboard',
  method: 'GET',
  headers: { 'Authorization': `Bearer ${userToken}` }
});

An attacker controlling a malicious upstream server (or performing a man-in-the-middle attack) could return a response with a malformed Cache-Control header:

HTTP/1.1 200 OK
Cache-Control: private="malformed\x00value", max-age=3600
Content-Type: application/json

{"user": "alice", "balance": "$10,000", "ssn": "123-45-6789"}

With the vulnerable undici version, this malformed private directive might be misinterpreted, causing the sensitive response to be cached and potentially served to other users making similar requests.

The Fix

The fix involved upgrading undici from version 7.28.0 to 7.29.0 (and ensuring compatibility with 8.9.0). Looking at the package-lock.json changes, we can see the dependency tree was restructured:

Before (Vulnerable)

{
  "integrity": "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==",
  "devOptional": true,
  "license": "MIT",
  "peer": true,
  "engines": {
    "node": ">= 20.19.0"
  }
}

After (Fixed)

{
  "integrity": "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==",
  "devOptional": true,
  "license": "MIT",
  "engines": {
    "node": ">= 20.19.0"
  }
}

The diff shows several changes to the dependency resolution:

1. Removed peer: true flags from multiple packages including undici itself, ensuring the fixed version is directly installed rather than relying on peer dependency resolution
2. Added peer: true flags to optional dependencies like fsevents and fs-extra to properly isolate them
3. Updated the dependency tree to ensure the patched undici version is resolved consistently

These changes ensure that:
- The application uses the fixed undici version directly
- The cache interceptor now properly validates Cache-Control directives
- Malformed private values are rejected or handled safely

Prevention & Best Practices

1. Keep Dependencies Updated

Use automated dependency scanning tools to catch known CVEs:

# Using npm audit
npm audit

# Using Trivy for comprehensive scanning
trivy fs --scanners vuln .

2. Implement Defense-in-Depth for Caching

Don't rely solely on upstream Cache-Control headers. Add application-level controls:

// Add explicit cache controls for sensitive routes
app.get('/api/user/sensitive-data', (req, res) => {
  res.set({
    'Cache-Control': 'no-store, no-cache, must-revalidate, private',
    'Pragma': 'no-cache',
    'Expires': '0'
  });
  // ... handle request
});

3. Validate HTTP Headers at the Application Level

Consider adding header validation before processing:

function validateCacheControl(header) {
  if (!header) return true;

  // Reject headers with null bytes or other suspicious characters
  if (/[\x00-\x1f]/.test(header)) {
    console.warn('Suspicious Cache-Control header detected');
    return false;
  }
  return true;
}

4. Use Lock Files and Pin Versions

Ensure your package-lock.json is committed and use exact version pinning for critical security dependencies:

{
  "dependencies": {
    "undici": "7.29.0"
  }
}

Key Takeaways

• Undici's cache interceptor required specific validation for malformed Cache-Control private directives—a parsing edge case that created both information disclosure and DoS risks
• The peer: true flag changes in package-lock.json ensured direct dependency resolution rather than relying on potentially vulnerable peer versions
• HTTP header parsing is security-critical—even well-established libraries can have subtle parsing flaws that create exploitable conditions
• Dependency scanning tools like Trivy caught this CVE before it could be exploited in production, demonstrating the value of automated security scanning
• Cache-related vulnerabilities can have severe privacy implications when user-specific data is incorrectly shared between requests

How Orbis AppSec Detected This

• Source: HTTP response headers from upstream servers, specifically the Cache-Control header value
• Sink: undici's cache interceptor parsing logic that processes and stores responses based on Cache-Control directives
• Missing control: Proper validation and rejection of malformed private directive values in Cache-Control headers
• CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests)
• Fix: Upgraded undici from 7.28.0 to 7.29.0/8.9.0, which includes proper validation of Cache-Control header parsing

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-13697 serves as a reminder that even fundamental HTTP operations like cache header parsing require rigorous validation. The undici library is widely used across the Node.js ecosystem, making this vulnerability particularly impactful. By upgrading to the patched versions (7.29.0 or 8.9.0) and implementing defense-in-depth caching strategies, developers can protect their applications from both this specific vulnerability and similar header parsing issues in the future.

Always treat HTTP headers as untrusted input, even when they come from seemingly trusted sources. Malformed headers can slip through at any point in the request chain, and your application's parsing logic must be prepared to handle them safely.

References

• CWE-444: Inconsistent Interpretation of HTTP Requests
• OWASP HTTP Response Splitting Prevention Cheat Sheet
• Undici Official Documentation
• Semgrep Rules for HTTP Header Validation
• fix: upgrade undici to 7.29.0, 8.9.0 (CVE-2026-13697)