undici's cache interceptor misparses Cache‑Control directives that contain optional whitespace around the equals sign in no‑cache or private directives. This causes the directive to be ignored or recorded incorrectly, allowing responses that would normally be deemed non‑cacheable to be stored in the shared cache. A subsequent request that resolves to the same cache key can retrieve a response containing another user's authenticated data, leading to cross‑user information disclosure.

Affected versions include undici releases from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0. Applications that enable the cache interceptor, operate in shared‑cache mode, forward Authorization headers, and receive cacheable responses with qualified Cache‑Control directives containing spaced‑around‑equals are vulnerable.

The CVSS score of 5.9 reflects its medium severity. The EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can induce the vulnerable behavior by crafting HTTP requests that trigger cacheable responses with the problematic directives. Based on the description, it is inferred that the likely attack vector involves these crafted requests sent to the cache interceptor. Once cached, an unauthenticated or other user can obtain sensitive data from the shared cache. The issue is fixed in undici 7.29.0 and 8.9.0.