undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-84933 · Microsoft / collected KEV context

EUVD-2026-71518

GHSA-2jfj-6hjv-fm6j

cve-program · CVE-2026-84933

• https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-71518

• https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-84933

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j

osv · GHSA-2jfj-6hjv-fm6j

• https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j
• https://nvd.nist.gov/vuln/detail/CVE-2026-84933
• https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988
• https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2

• undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that ca… · Advisory content revised · 5 Nov 2026