Detections
Analytics

SCA: security update for undici (GHSA-pr7r-676h-xcf6)

medium Tenable Cloud Security Plugin ID 443470

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream
 Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private="
 authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later
 comparisons against the literal authorization field name fail and the response is stored. In shared-cache
 mode, this allows a response containing one user's authenticated data to be served from cache to a
 subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.
 Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in
 shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical
 qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If
 upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization
 headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
 (CVE-2026-9678)

Solution

Update the undici library and its related packages to version 7.28.0 or later.

See Also

https://github.com/advisories/GHSA-pr7r-676h-xcf6

Plugin Details

Severity: Medium

ID: 443470

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 6/19/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-9678

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/18/2026

Vulnerability Publication Date: 6/17/2026

Reference Information

CVE: CVE-2026-9678

cwe: CWE-524