Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: undici 6.26.0, 7.28.0, 8.5.0 Clear all filters
TI-2026-09954 CVE-2026-11525 · GHSA-g8m3-5g58-fq7m

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Priority LOW 17

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00238 Published 2026-06-17 Partial fix · 6.26.0, 7.28.0 +2 CWE-183
TI-2026-08490 CVE-2026-9679 · GHSA-p88m-4jfj-68fv

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Priority LOW 26

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00257 Published 2026-06-17 Partial fix · 6.26.0, 7.28.0 +2 CWE-93