Undici’s cache interceptor mishandles malformed Cache‑Control headers that contain degenerate private directives, leading to a privacy‑violation weakness and a crash caused by malformed input. The vulnerability permits cross‑user information disclosure – a CWE‑200 privacy violation – by allowing an empty private directive to be cached in the shared default cache. When a distinct caller requests the same cache key, the library returns the cached body and sensitive headers such as Set‑Cookie, exposing private data. In addition, the parser throws an uncaught TypeError when an unqualified private directive is combined with a qualified one; unhandled, this terminates the Node.js process, causing a denial‑of‑service. The weakness involves multiple CWEs, including CWE‑200 and CWE‑248.

The vulnerability exists in undici version 7.0.0 through 7.28.99 and in 8.0.0 through 8.8.99. Applications that import the library’s default shared cache interceptor are affected. The patch is available in undici 7.29.0 and 8.9.0; upgrading to those or later releases removes both the information‑disclosure and the crash risks.

The CVSS score of 7.4 indicates a high level of risk, but the EPSS score is less than 1 %, implying exploitation is unlikely at present. The vulnerability is not in CISA’s KEV catalog. The likely attack vector is external: a malicious server or an attacker who controls the response can embed the degenerate directives, which are then processed by the application. A local attacker with the ability to submit crafted responses to the library can also trigger the issue. In either scenario, the attacker needs only to supply a response that contains the problematic Cache‑Control headers; no authentication or privileged access is required.