Use of cache containing sensitive information in undici - CVE-2026-84933
Published: September 6, 2026
Vulnerability identifier: #VU147178
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84933
CWE-ID: CWE-524
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose cookies belonging to other users and inject cookies into cached responses.
The vulnerability exists due to improper handling of sensitive cookies in undici\'s interceptors.cache() when handling cacheable responses containing Set-Cookie headers in shared-cache mode. A remote attacker can provide a cacheable response containing a Set-Cookie header to disclose cookies belonging to other users and inject cookies into cached responses.
Private-cache mode is not affected.
Affected software
undici
How to mitigate CVE-2026-84933
Install security update from vendor's website.
undici - addressed in versions 7.29.1, 8.10.2