Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84933— undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

Quick assessment

Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

undici 的缓存拦截器在其缓存处理路径中完全未处理 响应头，既不拒绝存储该头，也未将其剥离。在共享缓存模式下（这是默认模式），任何可缓存的响应如果携带 头（例如标记了 和 指令的响应），会被存入缓存，并在后续匹配相同缓存键的调用方请求时被重新提供。其结果是，一个调用方的 Cookie 会泄露给另一个不同的调用方，且不受信任的服务器可以向提供给所有后续调用方的缓存响应中注入 Cookie。这违反了“共享缓存不得存储 Cookie”的要求。受影响版本为 undici 7.0.0 至 7.29.1，以及 8.0.0

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

VendorProduct Version RangeStatus
undici undici 7.0.0< 7.29.1 affected
7.29.1 unaffected
8.0.0< 8.10.2 affected
8.10.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84933

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
Source: CVE Program / CVE List V5
Vulnerability Description
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
undici undici 7.0.0 ~ 7.29.1 -

II. Public POCs for CVE-2026-84933

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84933

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-84933 (1)

Same Patch Batch · undici · 2026-09-04 · 11 CVEs total

CVE-2026-19534 7.5 HIGH undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
CVE-2026-85152 7.4 HIGH undici vulnerable to cross-origin cache poisoning via missing origin isolation in intercep
CVE-2026-84961 7.4 HIGH undici vulnerable to TLS certificate validation bypass via dropped connect options in Bala
CVE-2026-85024 5.9 MEDIUM undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate
CVE-2026-85014 5.9 MEDIUM undici vulnerable to Denial of Service via WebSocketStream unclean close
CVE-2026-18149 5.9 MEDIUM undici vulnerable to Denial of Service via orphaned RetryHandler response body
CVE-2026-84890 5.9 MEDIUM undici vulnerable to Denial of Service via unbounded decompression of compressed responses
CVE-2026-85008 3.7 LOW undici vulnerable to caching and replay of unsafe HTTP method responses
CVE-2026-84947 3.7 LOW undici vulnerable to response truncation via oversized chunked responses in the dump inter
CVE-2026-18540 3.7 LOW undici vulnerable to downstream response splitting via retry interceptor

IV. Related Vulnerabilities

Same product: undici
Same vendor: undici
Same weakness: CWE-200

V. Comments for CVE-2026-84933

No comments yet

Leave a comment