GHSA-g8m3-5g58-fq7m
Low · 3.7CVSS
3.7
EPSS
—
Published
Jun 19, 2026
CISA due date
—
The record
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | undici | 0 | 6.27.0 |
| npm | undici | 7.0.0 | 7.28.0 |
| npm | undici | 8.0.0 | 8.5.0 |
Related vulnerabilities
- CVE-2026-11525 Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value… Same vulnerability
- GHSA-vxpw-j846-p89q undici WebSocket client vulnerable to denial of service via fragment count bypass Also affects undici
- GHSA-p88m-4jfj-68fv undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Also affects undici
- GHSA-hm92-r4w5-c3mj undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse Also affects undici
- GHSA-35p6-xmwp-9g52 undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse Also affects undici
- GHSA-vmh5-mc38-953g undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5… Also affects undici
- GHSA-pr7r-676h-xcf6 undici vulnerable to cross-user information disclosure via shared cache whitespace bypass Also affects undici
- GHSA-38rv-x7px-6hhq undici WebSocket client vulnerable to denial of service via cumulative fragment bypass Also affects undici