By weakness (CWE)

CWE-183: related vulnerabilities

CVEs classified under CWE-183. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-11525LOW 3.7

  Undici, a Node.js HTTP client library, incorrectly parses the SameSite attribute in Set-Cookie headers. Instead of validating that the attribute is exactly 'Strict', 'Lax', or 'None' as the HTTP specification requires, undici accepts any value containing one of those words as a substring and silently converts it to the closest match. This means a server sending a malformed cookie like 'SameSite=NoneOfYourBusiness' will be treated as 'None'—the least restrictive setting—potentially weakening the security properties applications expect from SameSite enforcement.