Skip to main content

Undici CVE-2026-84933

| EUVDEUVD-2026-71518 HIGH
Information Exposure (CWE-200)
2026-09-04 openjs GHSA-2jfj-6hjv-fm6j
Information Disclosure Undici
8.2
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-200
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 15, 2026

undici's cache interceptor mishandles the Set-Cookie response header, failing to either refuse storage or strip it, so in the default shared-cache mode a cacheable response carrying Set-Cookie is stored and later replayed to a different caller matching the same cache key. This discloses one caller's cookies to another party and lets an untrusted origin inject cookies into cached responses served to every subsequent caller. Affected are undici 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2; fixes are available in 7.29.1 and 8.10.2, exploitation is not confirmed in CISA KEV, EPSS probability is low (0.25%), and no public exploit code has been identified.

Earlier versions of this analysis (1)
v1 Sep 04, 2026 - 17:44 CVSS 6.5

Cookie leakage and injection in undici's shared cache interceptor allows one caller's Set-Cookie response header to be stored and re-served to unrelated callers in Node.js applications using undici 7.0.0-<7.29.1 or 8.0.0-<8.10.2. When an upstream server returns a response that is both explicitly marked cacheable (e.g., Cache-Control: public, max-age=N) and carries a Set-Cookie header, the interceptor violates RFC 7234 §7.2 by persisting and replaying the cookie to every subsequent caller matching the same cache key. This enables cross-user session disclosure and allows a malicious or compromised upstream server to inject persistent cookies into all downstream callers sharing the cache. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Affected VersionsENISA

undici 7.0.0 <7.29.1
undici 8.0.0 <8.10.2

Affected Packages

npm undici fix: 7.29.1, 8.10.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Undici gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (openjs) PRIMARY MEDIUM
NVD 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
vuln.today AI 6.5 MEDIUM

Shared cache active plus cacheable Set-Cookie co-presence plus matching key required justifies AC:H; session cookie exposure justifies C:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 6.5 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Red Hat 6.5 MEDIUM

Primary rating from Vendor (openjs).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Updated
Sep 15, 2026 - 14:57 vuln.today
v2 - CVSS changed
Severity Changed
Sep 15, 2026 - 14:52 NVD
MEDIUM HIGH
CVSS changed
Sep 15, 2026 - 14:52 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch available
Sep 04, 2026 - 18:03 EUVD
CVE Published
Sep 04, 2026 - 16:59 cve.org
MEDIUM 6.5

DescriptionNVD

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

Technical POC Analysis

Evidence note: the only artifact supplied is advisory GHSA-2jfj-6hjv-fm6j.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Threat Intelligence Overview

EPSS Score
0.2%
Top 84% exploitable
Threat Intel
1
1 source
Data Quality
8 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Undici

View all
CVE-2022-35949 CRITICAL POC
9.8 Aug 12

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
CVE-2026-12151 HIGH POC
7.5 Jun 17

Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
CVE-2026-14643 HIGH POC
7.5 Jul 29

Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from

CVE-2026-16729 MEDIUM POC
6.5 Jul 29

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
CVE-2022-31151 MEDIUM POC
6.5 Jul 21

Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
CVE-2022-32210 MEDIUM POC
6.5 Jul 14

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CVE-2026-15157 MEDIUM POC
5.4 Jul 29

CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
CVE-2023-23936 MEDIUM POC
5.4 Feb 16

Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

CVE-2022-35948 MEDIUM POC
5.3 Aug 15

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
CVE-2026-13697 CRITICAL
9.1 Jul 29

Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions

CVE-2026-109383 CRITICAL POC
9.1 Oct 15

Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0
CVE-2026-109829 CRITICAL POC
9.1 Oct 15

Persistent cache poisoning and disclosure of user-specific responses affect undici 7.0.0 through 7.30.0 and 8.0.0 throug

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:54389 ADVISORY https://access.redhat.com/errata/RHSA-2026:54438 ADVISORY https://access.redhat.com/errata/RHSA-2026:66008 ADVISORY https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988 ADVISORY https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a ADVISORY https://github.com/nodejs/undici/releases/tag/v7.29.1 ADVISORY https://github.com/nodejs/undici/releases/tag/v8.10.2 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-84933 ADVISORY https://vuldb.com/vuln/399080 REF https://cna.openjsf.org/security-advisories.html REF https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy