undici prior 7.29.1/8.10.2 Cache Interceptor information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in undici. Affected by this vulnerability is an unknown functionality of the component Cache Interceptor. Such manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-84933. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in undici. Affected by this issue is an unknown part of the component Cache Interceptor. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-84933 since 09/02/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 7.29.1 or 8.10.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-71518). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• undici

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion