undici Set-Cookie SameSite Attribute Downgrade Vulnerability (CVE-2026-11525)

undici Vulnerability Summary Vulnerability Overview Vulnerability Name: undici Set-Cookie SameSite Attribute Downgrade Vulnerability via Allowed Substring Matching Vulnerability ID: GHSA-g8m3-5g58-fq7m Severity: Low (CVSS 3.1 Base Score: 3.7/10) CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Scope of Impact Affected Versions: - = 7.0.0, = 8.0.0, < 8.5.0 Fixed Versions: - 6.26.0 - 7.28.0 - 8.5.0 Vulnerability Description When parsing the header, undici accepts attribute values containing the substrings "Strict", "Lax", or "None", rather than performing the case-insensitive exact match specified by RFC 6265. Non-canonical values are silently mapped to one of the three standard tokens: is parsed as , which is the most permissive setting. is parsed as , resulting in a downgrade from . Affected applications are those that consume header server responses (e.g., through undici’s Fetch or proxy code paths) and then forward or rely on the parsed attribute. A malicious or non-compliant server can force a consumer's cookie SameSite policy to downgrade to a weaker level, thereby silently downgrading cookie SameSite enforcement. This vulnerability was introduced when the cookies feature was added in undici 5.15.0. Remediation Patch: Upgrade to undici v6.26.0, v7.28.0, or v8.5.0. Workarounds After parsing the header, verify that the parsed attribute is exactly "Strict", "Lax", or "None" (case-insensitive) before forwarding or relying on it. Additional Information CVE ID: CVE-2026-11525 Weakness: CWE-183 Contributors: - UlisesGascon (Remediation reviewer) - KhalidDev (Remediation reviewer) - mcollina (Remediation developer)

Goal Reached Thanks to every supporter — we hit 100%!

undici Set-Cookie SameSite Attribute Downgrade Vulnerability (CVE-2026-11525)

More from this source