Based on the description, undici’s default shared cache interprets a Set‑Cookie header as an ordinary cacheable response, storing it without modification. When subsequently requested by another caller whose request matches the same cache key, the cached response—still containing the original Set‑Cookie header—is returned. This exposes the first caller’s cookie to an unrelated client, and an attacker can inject arbitrary cookies into a response that will then be cached and replayed to all future callers. The vulnerability is an information‑exposure flaw that maps to CWE‑200 and the caching of sensitive data, CWE‑524.

The issue is present in undici versions 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2 when the library operates in its default shared‑cache mode, which is enabled unless the application explicitly disables it.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the probability of exploitation is uncertain. The likely attack vector requires an attacker to send a cookie‑bearing response that the shared cache will accept—typically by controlling a server that the vulnerable application queries. If exploit succeeds, the attacker can obtain a victim’s session cookie, enabling session hijacking or unauthorized access. While the dependency on the shared cache reduces the attack surface, any environment that relies on undici’s shared‑cache mode could be affected.