# CVE-2026-84933: undici cache interceptor Set-Cookie disclosure in shared caches

Source: https://junglewise.ai/threats/cve-2026-84933-undici-cache-interceptor-set-cookie-disclosure-in-shared-caches  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84933 · Severity: medium · CVSS 6.5 · Published 2026-09-04

undici is a popular HTTP client library for Node.js that includes a caching interceptor to improve performance. When configured in shared-cache mode (the default), the caching layer fails to handle or strip Set-Cookie headers, causing authentication cookies from one user to be cached and re-served to other users. This allows attackers to steal session cookies and inject malicious cookies into responses seen by all subsequent users.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-84933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84933 being exploited in the wild.

**How severe is CVE-2026-84933?** Medium severity, with a CVSS score of 6.5, published 4 September 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=7.0.0,fixed=7.29.1.

**Is there a fix for CVE-2026-84933?** Yes. undici (npm): upgrade to 7.29.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84933 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84933?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 7.29.1 or later

  ```sh
  npm install undici@7.29.1
  ```


## Technical details

The vulnerability is a sensitive information exposure (CWE-200) and improper cache handling (CWE-524) in undici's cache interceptor. The root cause is that the cache path does not validate or strip Set-Cookie response headers before storing cacheable responses marked with public cache directives. When multiple clients hit the same cache key, a cached Set-Cookie from one client is re-served to others, violating RFC 6265 section 7.2 which requires shared caches to never store cookies. The attack requires network access to undici in shared-cache mode (default configuration) and targets multi-user or untrusted upstream scenarios. Patches are available in versions 7.29.1 and 8.10.2, which prevent storage and re-serving of responses containing Set-Cookie headers in shared-cache mode.

## Affected products

- OpenJS Foundation undici 7.0.0 to 7.29.0, 8.0.0 to 8.10.1

## Identifiers

- CVE-2026-84933
- GHSA-2jfj-6hjv-fm6j

## Timeline

- 2026-09-04: disclosed
- 2026-09-04: patched: Patches released in undici 7.29.1 and 8.10.2

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j](https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)