CVE-2026-84933

undici's cache interceptor never inspects, refuses to store, or strips the Set-Cookie response header along its cache path. In shared cache mode (the default), a cacheable response carrying Set-Cookie — for example one marked public with a max-age directive — is stored and later re-served to any caller matching the same cache key, disclosing one user's cookie to a different user and letting an untrusted origin server inject cookies into responses served to all subsequent callers. The flaw violates the HTTP caching requirement that a shared cache must not store cookies and affects applications using undici's caching interceptor on versions 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2. The vulnerability is rated high (CVSS 3.1: 8.2) due to network-reachable, low-complexity exploitation with high confidentiality impact. No public proof of concept is known and there is no evidence of in-the-wild exploitation to date.

What to do: Upgrade to undici 7.29.1 or later on the 7.x line, or 8.10.2 or later on the 8.x line. Until patched, disable the cache interceptor for responses that may carry Set-Cookie headers or run it in a non-shared-cache configuration, and audit any existing cache stores for persisted Set-Cookie entries. If cookie leakage is suspected, rotate affected session cookies and review logs for cross-user cache-key collisions on cookie-bearing endpoints.