Disclosure summary
### Impact undici's `interceptors.cache()` does not handle `Set-Cookie` in the cache path. In shared-cache mode (`type: 'shared'`, the default), a cacheable response (for example `Cache-Control: public, max-age=...`) carrying a `Set-Cookie` header is stored, and the stored `Set-Cookie` is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interceptor against untrusted or multi-user upstreams are affected. Private caches (`type: 'private'`) are not affected. ### Patches Upgrade to `7.29.1` or `8.10.2`. In shared-cache mode, undici no longer stores or re-serves responses containing `Set-Cookie`, including previously cached entries and revalidation paths. ### Workarounds Use a private cache (`type: 'private'`) for per-user responses, or avoid caching responses that set cookies. Applications acting as shared caches should strip `Set-Cookie` from responses before caching.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-2jfj-6hjv-fm6j
Open original source · Updated Sep 29, 2026
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
Source severity: MEDIUM / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | undici | >= 7.0.0, < 7.29.1 | 7.29.1 |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-09-29T14:19:58-04:00
MODIFIED 2026-09-29T14:19:59-04:00
INGESTED 2026-10-06T11:43:08-04:00