CVE-2026-84933 · GHSA-2jfj-6hjv-fm6j
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
- Risk score
- 48/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- undici's interceptors.cache() does not handle Set-Cookie in the cache path. In shared-cache mode (type: 'shared', the default), a cacheable response (for example Cache-Control: public, max-age=...) carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller that hits the same cache…
- Affected
- undici (npm) >= 7.0.0, < 7.29.1; undici (npm) >= 8.0.0, < 8.10.2
- Fix
- Upgrade undici to 7.29.1 or 8.10.2 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| undici | npm | >= 7.0.0, < 7.29.1 | 7.29.1 |
| undici | npm | >= 8.0.0, < 8.10.2 | 8.10.2 |
References
- https://github.com/advisories/GHSA-2jfj-6hjv-fm6j
- https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j
- https://nvd.nist.gov/vuln/detail/CVE-2026-84933
- https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988
- https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
- https://github.com/advisories/GHSA-2jfj-6hjv-fm6j
Original description
### Impact undici's `interceptors.cache()` does not handle `Set-Cookie` in the cache path. In shared-cache mode (`type: 'shared'`, the default), a cacheable response (for example `Cache-Control: public, max-age=...`) carrying a `Set-Cookie` header is stored, and the stored `Set-Cookie` is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (`type: 'private'`) are not affected. ### Patches Upgrade to `7.29.1` or `8.10.2`. In shared-cache mode, undici no longer stores or re-serves responses containing `Set-Cookie`, including previously cached entries and revalidation paths. ### Workarounds Use a private cache (`type: 'private'`) for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should strip `Set-Cookie` from responses before caching.
Last activity 29 Sep 2026. Patch Forecast updates every hour.