CVE-2026-84933: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
Vulnerability summary
CVE-2026-84933 is a high (CVSS 8.2) vulnerability in nodejs undici. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 23.1% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 04-09-2026PublishedVulnerability first disclosed.
- 04-09-2026Last modifiedVulnerability information updated.
Description
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
- OSV · NpmEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.30% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-524Use of Cache Containing Sensitive InformationThe code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard14 products
- code-server< 4.139.1-r2
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-19.4< 19.4.1-r1
Wolfi4 products
- code-server< 4.139.1-r2
- lernaAll versions (No fix recorded) | < 10.0.1-r11
- node-gyp< 13.0.2-r1
- prism< 5.16.0-r14
Debian1 product
- node-undiciAll versions (No fix recorded) | < 8.10.2+dfsg+~cs3.2.2-1
Nodejs1 product
- undici≥ 7.0.0, < 7.29.1 | ≥ 8.0.0, < 8.10.2
Npm1 product
- undici≥ 7.0.0, < 7.29.1 | ≥ 8.0.0, < 8.10.2
Ubuntu1 product
- node-undiciAll versions (No fix recorded)
Undici1 product
- undici≥ 7.0.0, < 7.29.1 | ≥ 8.0.0, < 8.10.2
7 vendors · 23 products
References
12 links
- github.com/nodejs/undiciPACKAGE