---
title: "CVE-2026-14643\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-14643?format=md
keywords: index, follow
---

# CVE-2026-14643

Publication date 29 July 2026

Last updated 7 August 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**5.9 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-14643?format=md#impact-score)

Toggle side navigation

## Description

undici's cache interceptor mishandles optional whitespace placed around the
equals sign of a qualified no-cache or private Cache-Control directive. In
undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0,
the parser either drops the directive or stores a field name with literal
quote characters, so the cache decision fails to recognize the
qualification and the response is stored. In shared-cache mode, this lets a
response containing one user's authenticated data be served from cache to a
later caller, including an unauthenticated one, when both requests resolve
to the same cache key. It affects applications that enable the cache
interceptor in shared mode, forward Authorization headers upstream, and
receive cacheable responses with qualified directives padded with
whitespace around the equals sign. This is the whitespace-around-equals
variant that the fix for CVE-2026-9678 did not normalize, and it is fixed
in undici 7.29.0 and 8.9.0.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| node-undici | 26.04 LTS resolute | Needs evaluation |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

5.9 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | High |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | None |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 5.9 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14643)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-14643)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-14643)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-14643)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-14643>
* <https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54>
* <https://cna.openjsf.org/security-advisories.html>