GHSA-2jfj-6hjv-fm6j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2jfj-6hjv-fm6j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-2jfj-6hjv-fm6j/GHSA-2jfj-6hjv-fm6j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2jfj-6hjv-fm6j
- Aliases
- Published
- 2026-09-29T18:19:58Z
- Modified
- 2026-09-29T18:30:41Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
- Details
-
Impact
undici's
interceptors.cache()does not handleSet-Cookiein the cache path. In shared-cache mode (type: 'shared', the default), a cacheable response (for exampleCache-Control: public, max-age=...) carrying aSet-Cookieheader is stored, and the storedSet-Cookieis re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (type: 'private') are not affected.Patches
Upgrade to
7.29.1or8.10.2. In shared-cache mode, undici no longer stores or re-serves responses containingSet-Cookie, including previously cached entries and revalidation paths.Workarounds
Use a private cache (
type: 'private') for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should stripSet-Cookiefrom responses before caching. - Database specific
{ "cwe_ids": [ "CWE-200", "CWE-524" ], "github_reviewed": true, "github_reviewed_at": "2026-09-29T18:19:58Z", "nvd_published_at": "2026-09-04T17:17:01Z", "severity": "MODERATE" }- References
-
- https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j
- https://nvd.nist.gov/vuln/detail/CVE-2026-84933
- https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988
- https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v7.29.1
- https://github.com/nodejs/undici/releases/tag/v8.10.2
Affected packages
npm / undici
Package
- Name
- undici
- View open source insights on deps.dev
- Purl
- pkg:npm/undici
npm / undici
Package
- Name
- undici
- View open source insights on deps.dev
- Purl
- pkg:npm/undici