Node undici: undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that… (CVE-2026-84933)

The undici HTTP client library for Node.js has a vulnerability in its shared cache interceptor component in versions 7.0.0 through before 7.29.1 and 8.0.0 through before 8.10.2. The cache interceptor does not properly handle the Set-Cookie response header, resulting in caching and re-serving of Set-Cookie headers to other users. This can cause cross-user cookie disclosure and allows untrusted upstream servers to inject cookies into cached responses, violating the HTTP cookie specification (RFC 6265). Private cache mode is not affected by this issue. The vulnerability is resolved in versions 7.29.1 and 8.10.2.

Exploitation of this vulnerability can lead to disclosure of cookies across users, potentially exposing sensitive session or authentication data. Additionally, untrusted upstream servers can inject cookies into cached responses, which may cause security policy violations or session manipulation. The vulnerability does not impact private cache mode, limiting the scope of affected deployments.

Upgrade undici to version 7.29.1 or later if using the 7.x series, or to version 8.10.2 or later if using the 8.x series. These versions contain the official fix that prevents caching and re-serving of Set-Cookie headers in the shared cache interceptor. No other mitigation is required as the issue is resolved in these versions.