Skip to main content

Undici CVE-2026-84933

| EUVDEUVD-2026-71518 HIGH
Information Exposure (CWE-200)
2026-09-04 openjs
Information Disclosure Undici
8.2
CVSS 3.1 · NVD
Share

Severity by source

Vendor (openjs) PRIMARY
MEDIUM
qualitative
NVD
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
vuln.today AI
6.5 MEDIUM

Shared cache active plus cacheable Set-Cookie co-presence plus matching key required justifies AC:H; session cookie exposure justifies C:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (openjs).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

7
Analysis Updated
Sep 15, 2026 - 14:57 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 15, 2026 - 14:52 vuln.today
cvss_changed
Severity Changed
Sep 15, 2026 - 14:52 NVD
MEDIUM HIGH
CVSS changed
Sep 15, 2026 - 14:52 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Sep 04, 2026 - 18:03 EUVD
Analysis Generated
Sep 04, 2026 - 17:44 vuln.today
CVE Published
Sep 04, 2026 - 16:59 cve.org
MEDIUM 6.5

DescriptionNVD

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

AnalysisAI

undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so in the default shared-cache mode a cacheable response carrying Set-Cookie is stored and later replayed to a different caller matching the same cache key. This discloses one caller's cookies to another party and lets an untrusted origin inject cookies into cached responses served to every subsequent caller. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-84961 CRITICAL
9.1 Sep 04

TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - includ
CVE-2026-6734 HIGH
8.8 Jun 17

Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-84933 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy