CVE-2026-84933
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
At a glance
- Source
- NVD
- EPSS
- EPSS 0.30 % · percentile 23 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- openjs
- NVD status
- Analyzed
Description
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- CWE-524 — Use of Cache Containing Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N | openjs |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · ce714d77-add3-4f53-aff5-83d477b104bb (Secondary) |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-2jfj-6hjv-fm6j — undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
European references
- ENISA EUVD · EUVD-2026-71518
- GCVE · GCVE-0-2026-84933
CERT-FR advisories
- CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1233 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*≥ 7.0.0 < 7.29.1cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*≥ 8.0.0 < 8.10.2
Affected products
| Product | Versions |
|---|---|
| undici · undici | affected 7.0.0 < 7.29.1 ; unaffected 7.29.1 ; affected 8.0.0 < 8.10.2 ; unaffected 8.10.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |