Interpretation Conflict Affecting org.webjars.npm:undici package, versions [7.0.0,7.29.0)[8.0.0,8.9.0)
Threat Intelligence
This vulnerability is trending on Twitter; this may indicate a growing threat.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGWEBJARSNPM-18426066
- published10 Aug 2026
- disclosed29 Jul 2026
- creditrampage0010
Introduced: 29 Jul 2026
NewCVE-2026-14643 (opens in a new tab)How to fix?
Upgrade org.webjars.npm:undici to version 7.29.0, 8.9.0 or higher.
Overview
org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js
Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing authenticated data to be stored and later served to another caller by sending a Cache-Control header with a qualified private or no-cache directive padded with optional whitespace around =. The parser misreads forms such as private ="" or no-cache= "authorization", so the cache logic fails to recognize the directive as a qualified restriction and treats the response as cacheable. In shared-cache deployments that forward Authorization headers, this exposes one user’s response body and cookies to a subsequent request for the same cache key, including an unauthenticated request.