undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
Impact
undici's interceptors.cache() does not handle Set-Cookie in the cache path. In shared-cache mode (type: 'shared', the default), a cacheable response (for example Cache-Control: public, max-age=...) carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (type: 'private') are not affected.
Patches
Upgrade to 7.29.1 or 8.10.2. In shared-cache mode, undici no longer stores or re-serves responses containing Set-Cookie, including previously cached entries and revalidation paths.
Workarounds
Use a private cache (type: 'private') for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should strip Set-Cookie from responses before caching.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | undici | >= 7.0.0, < 7.29.1, >= 8.0.0, < 8.10.2 | 7.29.1, 8.10.2 |
Referencias
- https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j
- https://nvd.nist.gov/vuln/detail/CVE-2026-84933
- https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988
- https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N- Debilidad (CWE)
CWE-200, CWE-524- Plataforma
- npm
- Paquete
undici- Publicada
- 29.09.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-2jfj-6hjv-fm6j - CC BY 4.0
Historial de vulnerabilidades: undici
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 46
- Primera → última
- 06.2022 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 13
- Media 21
- Baja 12
Divulgaciones por año
- 2022: 5
- 2023: 3
- 2024: 5
- 2025: 2
- 2026: 31
-
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.