Skip to content
Log inStart free trial

GHSA-g8m3-5g58-fq7m CVE-2026-11525

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Low npm
Severity
3.7 / 10
Low · CVSS 3.1
Exploit chance (EPSS)
0.24%
Chance of exploitation in the next 30 days. Higher than 14.96% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-183 Permissive List of Allowed Inputs
Fix
6.27.0
Upgrade undici to this version or later

Description

Impact

When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens:

  • SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting.
  • SameSite=StrictLax is parsed as Lax, a downgrade from Strict.

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches

Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.

Workarounds

After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Affected versions

npm

PackageVulnerableFixed in
undici
< 6.27.0
6.27.0
undici
>= 7.0.0, < 7.28.0
7.28.0
undici
>= 8.0.0, < 8.5.0
8.5.0
undici
< 6.27.0
6.27.0
undici
>= 7.0.0, < 7.28.0
7.28.0
undici
>= 8.0.0, < 8.5.0
8.5.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

undici npm → 6.27.0

npm
npm install undici@6.27.0
yarn
yarn add undici@6.27.0
pnpm
pnpm add undici@6.27.0

Severity breakdown

CVSS 3.1 3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Weakness

CWE-183: Permissive List of Allowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-55wc-3pg8-jfw6
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
High Also affects undici
GHSA-qrxm-fqhp-jwvm
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
High Also affects undici
GHSA-9fm3-97px-rjf6
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
High Also affects undici
GHSA-4qv8-2p9j-2685
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
High Also affects undici
GHSA-xjj6-f33q-929c
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
High Also affects undici
GHSA-f72v-6w45-q472
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
High Also affects undici
GHSA-4w7w-5xrc-9h26
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
Critical Also affects undici
GHSA-2m5v-pch6-74hx
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
Critical Also affects undici

Credits: KhafraDev, UlisesGascon, mcollina

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor