When the Cache-Control header is set to no-store, the response is cached.

[mengxun]

settings.py

...
MIDDLEWARE = [
    "django.middleware.cache.UpdateCacheMiddleware", 
    "django.middleware.common.CommonMiddleware",
    "django.middleware.cache.FetchFromCacheMiddleware", 
]
...

views.py

from django.http import HttpResponse
import datetime

def cache_demo(request):
    resp = HttpResponse(f"Current content at {datetime.datetime.now()}")
    resp["Cache-Control"] = "no-store"
    return resp

Based on the example above, when the Cache-Control header is set to no-store, the response content is still cached.

[Sarah Boyce]

Similar to #28833, can work around by using @never_cache

[Jagadesha NH]

I can work on these changes

[Jagadesha NH]

Seems like, someone has already raised a PR

[Sarah Boyce <42296566+sarahboyce@…>]

In ed7c1a56:

Fixed #36560 -- Prevented UpdateCacheMiddleware from caching responses with Cache-Control 'no-cache' or 'no-store'.

[Natalia <124304+nessita@…>]

In 366d9ae:

[5.2.x] Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitively in UpdateCacheMiddleware.

Thanks Ahmed Badawe for the report, and Jacob Walls for reviews.

This commit includes:

[5.2.x] Fixed #36560 -- Prevented UpdateCacheMiddleware from caching responses with Cache-Control 'no-cache' or 'no-store'.

Backport of ed7c1a56400d64f109f30df3ce697984cdad7c75 from main.

Backport of d618d7ae4fec727d5b582bd24f803c28d17bf7cd from main.

[Jacob Walls <jacobtylerwalls@…>]

In 142b881:

Refs #36560, CVE-2026-35193 -- Replaced substring check on cache-control directives in UpdateCacheMiddleware.

Avoid false positives from hypothetical extension directives
that could be superstrings of the ones we are checking.

[Jacob Walls <jacobtylerwalls@…>]

In b615947:

[6.1.x] Refs #36560, CVE-2026-35193 -- Replaced substring check on cache-control directives in UpdateCacheMiddleware.

Avoid false positives from hypothetical extension directives
that could be superstrings of the ones we are checking.

Backport of 142b881cecaddc334cabec139e701c0e4b9798da from main.