Threat Intelligence Report — CVE-2026-84933

Executive Summary

CVE-2026-84933 is an information-disclosure and cache-poisoning vulnerability in undici, the HTTP/1.1 client library bundled with Node.js and widely used as a standalone package. The cache interceptor component never inspects the Set-Cookie response header, so in the default shared cache mode it stores and re-serves responses carrying cookies to callers that match the same cache key. This causes one user's session cookie to leak to a different user, and it allows an untrusted origin server to inject cookies into cached responses distributed to all subsequent callers. Any Node.js application using undici's caching interceptor as a shared cache (the default) is affected; the impact is session hijacking and cookie-injection attacks, rated CVSS 6.5.

Technical Analysis

Undici is Node.js's native HTTP client and the foundation of global fetch() in modern Node.js runtimes. Its cache interceptor implements HTTP caching semantics (RFC 9111-style) and operates in one of two modes: a shared cache mode (the default) and a private/local cache mode. Shared caches are subject to a stricter rule set than private caches — most notably, a shared cache must not store a response that contains a Set-Cookie header, because doing so would make one client's cookies visible to another client.

The flaw here is a comprehension and enforcement gap in the caching path: the interceptor parses response directives sufficient to decide cacheability (e.g. public, max-age) but contains no handling of the Set-Cookie header anywhere in its cache path. Consequently it does not:

1. Refuse to store a response that carries Set-Cookie, even in shared cache mode; nor
2. Strip the Set-Cookie header from a stored response before re-serving it.

The result is a two-part failure that maps directly to CWE-200:

• Cross-caller cookie disclosure. A response that is "otherwise cacheable" and marked with public and max-age (both of which override the default heuristic non-cacheability of responses containing Set-Cookie) is stored verbatim, including its Set-Cookie header. A later request that matches the same cache key is served that stored response — with the original caller's cookie attached — to a different caller.
• Cookie injection from an untrusted origin. Because the header is neither stripped nor refused, a malicious or compromised origin server can return a cacheable response carrying a crafted Set-Cookie, poisoning the shared cache. Every subsequent caller matching the cache key receives the injected cookie.

The vulnerable surface is not a request parser or a TLS layer — it is the cacheability decision logic inside the interceptor. The default shared-cache posture is what transforms an ordinary header-handling omission into a cross-tenant confidentiality break. The CVSS vector reflects this accurately: AC:H (exploitation depends on the target issuing a cacheable, cookie-bearing response and a second caller matching the same cache key — somewhat constrained), C:H (full disclosure of cookie material, which typically equates to session takeover), and I:L (limited integrity impact via cookie injection).

Note: the NVD description does not name specific functions, classes, or modules, so no code-level symbol names can be asserted here. The mechanism described above is derived strictly from the advisory text.

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred at the vulnerability-class level from the NVD description and must not be read as a verified exploit recipe.

1) Reconnaissance / target identification. An attacker identifies a Node.js service that (a) uses undici's cache interceptor in the default shared-cache mode and (b) fronts a cache key that a victim (or many users) will subsequently request — for example, a shared API gateway, SSR layer, or proxy built on undici. Shared infrastructure where multiple tenants hit the same URL and query parameters is the ideal target.

2) Triggering the flaw class. The attacker causes (or simply exploits the natural occurrence of) a response that is otherwise cacheable and additionally carries a Set-Cookie header — the description gives the example of a response marked with public and max-age directives. Because the interceptor neither refuses to store nor strips Set-Cookie, that response enters the shared cache intact.

3) Payload / execution method. Two distinct delivery paths exist at the vulnerability-class level:

• Passive disclosure: a legitimate user's response, containing their cookie, is cached; a second caller who matches the same cache key is then served that response and receives the first user's cookie — cookie disclosure without any server-side malice.
• Active injection: an untrusted origin returns a cacheable response with an attacker-controlled Set-Cookie. The shared cache stores it, and the attacker's cookie is served to every subsequent caller matching the key — cookie injection into other users' browser/session context.

4) Post-exploitation impact. Disclosed cookies (typically session identifiers) enable session hijacking — impersonation of the victim on the upstream application. Injected cookies enable persistent manipulation of victim sessions at scale, and can be used for tracking, forced-session scenarios, or chaining into authenticated actions if the forged cookie is subsequently trusted. The cache-key scope determines blast radius: a broadly shared key poisons many users from a single stored response.

Impact Assessment

• Confidentiality (CVSS C:H): Complete loss of secrecy for cookie material that flows through a shared undici cache — session tokens, auth cookies, and any sensitive value carried in Set-Cookie. This is the dominant risk and the reason for the High confidentiality subscore.
• Integrity (CVSS I:L): Cookie injection lets an attacker alter the client-side cookie state of downstream callers, but the impact is bounded by how the consuming application trusts those cookies.
• Scope/Blast radius: Undici is embedded in the Node.js runtime (fetch) and consumed as a library by an enormous number of backend services, proxies, SSR frameworks, and CLIs. However, impact is conditional — it requires the application to actually use the cache interceptor in shared mode. Services that never enable caching, or run in private mode, are not exposed.
• Business impact: Potential account takeover via session hijacking, cross-tenant data exposure in multi-tenant SaaS, and reputational/regulatory consequences from unauthorized disclosure of user identifiers. CVSS 6.5 (Medium) with AC:H reflects that exploitation needs a favorable cache topology but yields high-value confidentiality loss when achieved.

EPSS 0.00248 (≈16th percentile) and no CISA KEV listing indicate low current observed exploitation pressure — consistent with the lack of public PoC.

Detection Guidance

Sigma Rule

title: Undici Shared Cache Serving Set-Cookie Response (CVE-2026-84933)
id: 8f3c1a92-4d7e-4b21-9c55-7a0e6f2b1d10
status: experimental
description: Detects Node.js/undici processes where cacheable responses carrying Set-Cookie are logged, indicating possible shared-cache cookie disclosure or injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84933
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith: '/node'
  selection_flags:
    CommandLine|contains:
      - 'undici'
      - 'cache-interceptor'
      - 'shared-cache'
  condition: selection_proc and selection_flags
falsepositives:
  - Legitimate use of undici in non-cache mode
level: medium
tags:
  - attack.t1190
  - cve.2026.84933

YARA Rule

rule CVE_2026_84933_Undici_SetCookie_Cache
{
    meta:
        description = "Detects undici cache interceptor source/artifacts lacking Set-Cookie handling (CVE-2026-84933)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84933"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $cache   = "cache interceptor" ascii nocase
        $shared  = "shared" ascii nocase
        $setck   = "set-cookie" ascii nocase
        $cachek  = "cache-control" ascii nocase
        $pubd    = "public" ascii

    condition:
        filesize < 2MB and
        ( $cache or $shared ) and $cachek and
        ( not $setck )
}

(Rule targets the genuine weakness: cache-handling code that references cache-control/public but never references set-cookie. Apply to undici source trees or bundled node_modules.)

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84933 undici shared-cache response storing Set-Cookie"; flow:to_client,established; http.response_header; content:"Set-Cookie"; nocase; http.response_header; content:"Cache-Control"; nocase; http.response_header; content:"public"; nocase; classtype:attempted-recon; reference:cve,2026-84933; sid:202684933; rev:1;)

(Flags upstream responses that are simultaneously marked cacheable/public and carry Set-Cookie — the exact combination that undici fails to reject.)

Elastic Detection

process where process.name == "node" and
process.command_line : ("*undici*" or "*cache*interceptor*" or "*shared*cache*")

// Response-header oriented EQL for HTTP telemetry pipelines:
network where http.response.headers : ("*Set-Cookie*") and
http.response.headers : ("*Cache-Control: public*") and
http.response.headers : ("*max-age*")

Splunk SPL Query

index=node OR index=web
| search (process_name="node" OR sourcetype="nodejs:access")
| where match(_raw, "(?i)set-cookie") AND match(_raw, "(?i)cache-control") AND match(_raw, "(?i)(public|max-age)")
| stats count values(uri) as uris by host, src_ip
| where count > 1
| sort -count

Wazuh OSSEC Rule

<group name="nodejs,undici,cve-2026-84933">
  <rule id="2026849" level="8">
    <decoded_as>json</decoded_as>
    <field name="message">set-cookie</field>
    <regex type="pcre2">(?i)(undici|cache[_-]?interceptor|shared[_-]?cache)</regex>
    <description>CVE-2026-84933: undici shared cache handling response with Set-Cookie header</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84933,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 4/4 (CONFIRMED — NVD, OSV, and RHSA independently confirm the fix).

1) Immediate mitigations (if upgrade is delayed):

• Disable the shared cache behavior in undici's cache interceptor — operate in private/local cache mode only, which avoids the shared-cache confidentiality violation.
• Where feasible, avoid caching responses that may carry Set-Cookie; enforce this at an upstream proxy or fetch wrapper layer since undici itself (in affected versions) will not strip the header.
• Add an application-level guard that rejects or strips Cache-Control: public on any response bearing Set-Cookie before it reaches the shared cache.

2) Patch / upgrade steps:

• Upgrade undici to 7.29.1 (for the 7.x line) or 8.10.2 (for the 8.x line).
• If undici is used transitively via Node.js's bundled fetch, update to a Node.js release that ships a patched undici, or override the dependency explicitly (npm i undici@7.29.1 / undici@8.10.2) and audit lockfiles (npm ls undici, yarn why undici).
• Rebuild containers and re-deploy; verify the resolved version with npm ls undici --depth=0.

3) Long-term hardening:

• Treat HTTP caches as trust boundaries: a shared cache must never retain credentials or Set-Cookie material — codify this as an invariant and test for it.
• Pin and continuously monitor undici and Node.js versions against OSV/GitHub Advisory feeds; add SCA scanning to CI.
• Adopt cache-key design that isolates tenants/users where shared caching is unavoidable, to limit the blast radius of any future cache-layer defect.

References

1. NVD — CVE-2026-84933: https://nvd.nist.gov/vuln/detail/CVE-2026-84933
2. OSV — undici advisory entry for CVE-2026-84933: https://osv.dev/vulnerability/CVE-2026-84933
3. Red Hat Security Advisory (RHSA) — undici update: https://access.redhat.com/security/cve/CVE-2026-84933
4. Node.js project — undici repository / release notes for 7.29.1 and 8.10.2: https://github.com/nodejs/undici/releases
5. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html

Threat actor / exploit-in-the-wild evidence: None. CVE-2026-84933 is not listed in CISA KEV, has no public PoC, no Nuclei template, and no exploit code available as of this report. EPSS is 0.00248 (≈16.3rd percentile), indicating low near-term exploitation likelihood.