undici: Undici: Information disclosure due to improper cache-control header parsing

LLM-synthesized narrative grounded in this CVE's description and references.

Versions sourced from the GitHub Security Advisory.

• Npm/Undiciinferred

  Package: https://npmjs.com/package/undici
• Undici/Undicillm-fuzzy
• osv-coords45 versions

  pkg:apk/chainguard/code-serverpkg:apk/chainguard/gemini-clipkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/langfuse-3pkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-3pkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/pelias-apipkg:apk/chainguard/py3.10-captumpkg:apk/chainguard/py3.11-captumpkg:apk/chainguard/py3.12-captumpkg:apk/chainguard/py3.13-captumpkg:apk/chainguard/renovatepkg:apk/chainguard/vitess-24pkg:apk/wolfi/code-serverpkg:apk/wolfi/langfuse-3pkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/renovatepkg:apk/wolfi/vitess-24pkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-develpkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweed

  < 4.125.0-r2+ 44 more

  • (no CPE)range: < 4.125.0-r2
  • (no CPE)range: < 0.49.0-r4
  • (no CPE)range: < 9.1.10-r21
  • (no CPE)range: < 9.1.10-r21
  • (no CPE)range: < 9.2.8-r9
  • (no CPE)range: < 9.2.8-r9
  • (no CPE)range: < 9.3.5-r4
  • (no CPE)range: < 9.3.5-r4
  • (no CPE)range: < 9.4.2-r5
  • (no CPE)range: < 9.4.2-r5
  • (no CPE)range: < 3.194.0-r0
  • (no CPE)range: < 3.194.0-r0
  • (no CPE)range: < 3.194.0-r0
  • (no CPE)range: < 3.194.0-r0
  • (no CPE)range: < 7.8.0-r4
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 43.247.0-r0
  • (no CPE)range: < 24.0.2-r1
  • (no CPE)range: < 4.125.0-r2
  • (no CPE)range: < 3.194.0-r0
  • (no CPE)range: < 3.194.0-r0
  • (no CPE)range: < 43.247.0-r0
  • (no CPE)range: < 24.0.2-r1
  • (no CPE)range: < 1:22.23.1-2.el10_2
  • (no CPE)range: < 1:24.18.0-1.el10_2
  • (no CPE)range: < 1:24.18.0-1.el10_2
  • (no CPE)range: < 1:24.18.0-1.el10_2
  • (no CPE)range: < 1:24.18.0-1.el10_2
  • (no CPE)range: < 1:24.18.0-1.el10_2
  • (no CPE)range: < 1:11.16.0-1.24.18.0.1.el10_2
  • (no CPE)range: < 1:22.23.1-2.el10_2
  • (no CPE)range: < 1:22.23.1-2.el10_2
  • (no CPE)range: < 1:22.23.1-2.el10_2
  • (no CPE)range: < 1:22.23.1-2.el10_2
  • (no CPE)range: < 3.0.3-3.module_el9.7.0+209+ecf6523e
  • (no CPE)range: < 1:10.9.8-1.22.23.1.2.el10_2
  • (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
  • (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
  • (no CPE)range: < 1:11.16.0-1.24.18.0.1.module_el9.8.0+277+61fc613e
  • (no CPE)range: < 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47
  • (no CPE)range: < 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e
  • (no CPE)range: < 24.17.0-1.1

• github.com/advisories/GHSA-pr7r-676h-xcf6ghsaADVISORY
• nvd.nist.gov/vuln/detail/CVE-2026-9678ghsaADVISORY
• cna.openjsf.org/security-advisories.htmlghsaWEB
• github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6ghsaWEB

No linked articles in our index yet.