CVE-2026-84933 Nodejs CVE debrief

Who should care

Node.js developers and administrators using undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2 should assess exposure and upgrade to undici 7.29.1 or 8.10.2 to prevent sensitive cookie disclosure

Why it matters

CVE-2026-84933 is a vulnerability in undici's cache interceptor that allows sensitive cookie information to be disclosed between different callers in shared cache mode. Node.js developers and administrators should assess exposure and upgrade to undici 7.29.1 or 8.10.2 to prevent sensitive cookie disclosure.

• Sensitive cookie information disclosure between different callers in shared cache mode
• Potential for unauthorized access to sensitive information
• Need for upgrade to undici 7.29.1 or 8.10.2 to prevent vulnerability

Technical summary

The vulnerability is caused by undici's cache interceptor not handling the Set-Cookie response header properly, allowing sensitive cookie information to be disclosed between different callers in shared cache mode. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. The issue violates the requirement that a shared cache must not store cookies, potentially leading to unauthorized access to sensitive information. Users should upgrade to undici 7.29.1 or 8.10.2 to prevent sensitive cookie disclosure.

Defensive priority

Upgrade to undici 7.29.1 or 8.10.2 to prevent sensitive cookie disclosure

Recommended defensive actions

• Upgrade to undici 7.29.1 or 8.10.2
• Review and update affected systems
• Monitor for potential cookie disclosure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by undici's cache interceptor not handling the Set-Cookie response header properly, allowing sensitive cookie information to be disclosed between different callers in shared cache mode.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.