{
  "cveId": "CVE-2026-84933",
  "url": "https://patchblox.com/security/cve/CVE-2026-84933",
  "summary": "CVE-2026-84933 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-84933, released September 10, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "node-undici: undici\u0027s cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither r...",
  "description": "undici\u0027s cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller\u0027s cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.",
  "published": "2026-09-04T17:17:01Z",
  "severity": "high",
  "cvss": 8.2,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
  "epss": 0.00303,
  "epssPercentile": 0.23197,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 14",
      "fixedVersion": "8.10.2\u002Bdfsg\u002B~cs3.2.2-1",
      "fix": "DEBIAN-CVE-2026-84933",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-84933",
      "released": "2026-09-10T12:12:19Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-docs",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-full-i18n",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-libs",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:24.21.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-npm",
      "release": "amzn 2023",
      "fixedVersion": "1:11.19.0-1.24.21.0.1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "pi-coding-agent",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.0.4-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22111-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22111-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "v8-13.6-devel",
      "release": "amzn 2023",
      "fixedVersion": "3:13.6.233.17-1.24.21.0.1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3107",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3107",
      "released": "2026-09-28T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}