CVE-2026-9678

描述

## Impact Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream `Cache-Control` header uses whitespace-padded qualified `private` or `no-cache` field names such as `private=" authorization"` or `no-cache="\tauthorization"`. The parser preserves the surrounding whitespace, so later comparisons against the literal `authorization` field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (`interceptors.cache()`) in shared mode, forward `Authorization` headers upstream, and receive cacheable responses with non-canonical qualified `private` or `no-cache` directives. ## Patches Upgrade to undici v7.28.0 or v8.5.0. ## Workarounds If upgrade is not immediately possible, disable shared-cache mode for traffic that includes `Authorization` headers, avoid caching responses to authenticated requests, or add `Vary: Authorization` upstream.

如何修補 CVE-2026-9678

要修補 CVE-2026-9678,請將受影響套件升級到下列已修補版本。

• —未列出修補版本
• —升級至 7.28.0 或更新版本

CVE-2026-9678 正在被利用嗎?

目前沒有被利用訊號。CVE-2026-9678 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(2)

• from 0
• >= 7.0.0, < 7.28.0

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-9678
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-9678
• PATCHgithub.com/nodejs/undici
• WEBcna.openjsf.org/security-advisories.html
• WEB