CVE-2026-84933

A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.

This flaw affects applications that use undici's shared-cache interceptor (interceptors.cache(), type: 'shared', which is the default) against untrusted or multi-tenant upstream servers. In that configuration, undici stores and re-serves the Set-Cookie header of cached responses, allowing one user's session cookie to be disclosed to another caller that hits the same cache key, and allowing a malicious upstream to inject cookies into responses served to other users. Applications that only use undici as an HTTP client without enabling the shared cache interceptor, or that only use the private cache mode, are not affected. Red Hat products that bundle undici versions prior to 7.0.0 (5.x/6.x lines) are not affected, as the vulnerable cache interceptor was introduced in undici 7.0.0.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to undici 7.29.1 or 8.10.2 (or later), where the shared cache interceptor no longer stores or re-serves responses containing Set-Cookie. Where an immediate upgrade is not possible: use a private cache (type: 'private') for per-user responses instead of the shared cache; avoid caching responses that carry a Set-Cookie header; or, if your service itself acts as a shared cache in front of an untrusted origin, strip Set-Cookie from upstream responses before caching them.