{"id":"GHSA-2jfj-6hjv-fm6j","summary":"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches","details":"### Impact\n\nundici's `interceptors.cache()` does not handle `Set-Cookie` in the cache path. In shared-cache mode (`type: 'shared'`, the default), a cacheable response (for example `Cache-Control: public, max-age=...`) carrying a `Set-Cookie` header is stored, and the stored `Set-Cookie` is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (`type: 'private'`) are not affected.\n\n### Patches\n\nUpgrade to `7.29.1` or `8.10.2`. In shared-cache mode, undici no longer stores or re-serves responses containing `Set-Cookie`, including previously cached entries and revalidation paths.\n\n### Workarounds\n\nUse a private cache (`type: 'private'`) for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should strip `Set-Cookie` from responses before caching.","aliases":["CVE-2026-84933"],"modified":"2026-09-29T18:30:41.174435110Z","published":"2026-09-29T18:19:58Z","database_specific":{"nvd_published_at":"2026-09-04T17:17:01Z","cwe_ids":["CWE-200","CWE-524"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-29T18:19:58Z"},"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"affected":[{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2jfj-6hjv-fm6j/GHSA-2jfj-6hjv-fm6j.json"}},{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.10.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2jfj-6hjv-fm6j/GHSA-2jfj-6hjv-fm6j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"}]}