Executive brief
undici is a popular HTTP client library for Node.js that includes a caching interceptor to improve performance. When configured in shared-cache mode (the default), the caching layer fails to handle or strip Set-Cookie headers, causing authentication cookies from one user to be cached and re-served to other users. This allows attackers to steal session cookies and inject malicious cookies into responses seen by all subsequent users.
Technical details
The vulnerability is a sensitive information exposure (CWE-200) and improper cache handling (CWE-524) in undici's cache interceptor. The root cause is that the cache path does not validate or strip Set-Cookie response headers before storing cacheable responses marked with public cache directives. When multiple clients hit the same cache key, a cached Set-Cookie from one client is re-served to others, violating RFC 6265 section 7.2 which requires shared caches to never store cookies. The attack requires network access to undici in shared-cache mode (default configuration) and targets multi-user or untrusted upstream scenarios. Patches are available in versions 7.29.1 and 8.10.2, which prevent storage and re-serving of responses containing Set-Cookie headers in shared-cache mode.
Affected products
- OpenJS Foundation undici 7.0.0 to 7.29.0, 8.0.0 to 8.10.1
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Patches released in undici 7.29.1 and 8.10.2