CVE-2026-84933 Overview
CVE-2026-84933 affects undici, the HTTP/1.1 client used by Node.js. The library's cache interceptor fails to handle the Set-Cookie response header anywhere in its cache path. It neither refuses to store responses containing cookies nor strips the header before serving them from cache.
In shared cache mode, which is the default, a cacheable response carrying Set-Cookie alongside directives such as public and max-age is stored and later re-served to different callers matching the same cache key. One caller's cookie is disclosed to another caller, and an untrusted origin can inject cookies into cached responses served to every subsequent caller. This behavior violates the requirement that a shared cache must not store cookies [CWE-200].
Critical Impact
Session cookies can leak across users of the same undici client, and an attacker-controlled server can plant arbitrary cookies into responses served to downstream consumers.
Affected Products
- undici versions 7.0.0 through 7.29.0
- undici versions 8.0.0 through 8.10.1
- Node.js applications and services using undici's cache interceptor in shared cache mode
Discovery Timeline
- 2026-09-04 - CVE-2026-84933 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84933
Vulnerability Analysis
The undici cache interceptor implements HTTP caching semantics for responses fetched through the client. RFC 7234 requires that a shared cache never store responses containing Set-Cookie unless the response explicitly permits it, because those cookies belong to the individual caller.
The interceptor omits this check. Any response that appears cacheable, for example one marked Cache-Control: public, max-age=3600, is stored verbatim including the Set-Cookie header. When a later request produces the same cache key, undici returns the stored response and delivers the original caller's cookies to the new caller.
The flaw enables two related outcomes. First, sensitive session identifiers issued to one user leak to any other user whose request hits the cached entry. Second, an untrusted or compromised upstream server can deliberately attach Set-Cookie to a cacheable response and poison the shared cache, injecting attacker-chosen cookies into every subsequent client that consumes the entry.
Root Cause
The cache path lacks logic to inspect response headers for Set-Cookie and act on it. A compliant shared cache implementation must either refuse to store the response or strip the Set-Cookie header before storage. Neither branch exists in affected versions.
Attack Vector
Exploitation requires network access to trigger requests through an application that uses undici with the cache interceptor enabled. An attacker who controls an upstream HTTP endpoint contacted by the victim application can craft a response with cacheable directives and a chosen Set-Cookie value. Once cached, the malicious header propagates to other callers sharing the cache key. Passive disclosure requires no active attacker: any authenticated response cached by mistake exposes its cookies to the next matching request.
Refer to the GitHub Advisory GHSA-2jfj-6hjv-fm6j for the upstream technical description.
Detection Methods for CVE-2026-84933
Indicators of Compromise
- Cached responses served by undici that contain Set-Cookie headers, observable through client-side logging or proxy inspection.
- Unexpected session identifiers or authentication cookies appearing on requests from users who never authenticated.
- Cache entries whose stored headers include both Cache-Control: public and Set-Cookie.
Detection Strategies
- Audit dependency manifests (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml) for undici versions in the vulnerable ranges 7.0.0–7.29.0 and 8.0.0–8.10.1.
- Enable request and response logging around the cache interceptor and alert on any cached response header set that includes set-cookie.
- Review upstream services called through undici for endpoints that emit Set-Cookie on responses marked cacheable.
Monitoring Recommendations
- Forward Node.js application logs and outbound HTTP telemetry to a centralized analytics platform for cross-user cookie correlation.
- Monitor for session anomalies such as a single session identifier bound to multiple distinct client IPs within a short window.
- Track deployed undici versions across the fleet through software composition analysis and flag any regression to a vulnerable release.
How to Mitigate CVE-2026-84933
Immediate Actions Required
- Upgrade undici to version 7.29.1 or 8.10.2 in every affected service and rebuild container images.
- Disable the cache interceptor in applications that cannot be patched immediately, particularly those handling authenticated traffic.
- Rotate or invalidate session cookies that may have been exposed through the shared cache while the vulnerable version was in use.
Patch Information
The maintainers fixed the issue in undici 7.29.1 and 8.10.2. Users on the 7.x line should move to 7.29.1 or later, and users on the 8.x line should move to 8.10.2 or later. See the OpenJS Foundation Security Advisories for release notes.
Workarounds
- Remove the cache interceptor from the undici dispatcher configuration until the upgrade is applied.
- Configure upstream services to send Cache-Control: private, no-store on any response that includes Set-Cookie.
- Route authenticated requests through a separate undici client instance that has caching disabled.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
