CVE-2026-11525: Undici Set-Cookie SameSite Parsing Vulnerability

Technical summary

CVE-2026-11525 is a cookie attribute parsing vulnerability in undici (introduced in v5.15.0) where Set-Cookie SameSite validation fails to implement RFC 6265 correctly. The parser uses substring matching rather than case-insensitive exact matching, accepting non-compliant values and mapping them to standard tokens. For example, 'SameSite=StrictLax' maps to 'Lax' (a downgrade), and 'SameSite=NoneOfYourBusiness' maps to 'None' (the permissive default). Applications that parse Set-Cookie responses and forward or rely on the sameSite attribute inherit this weakened enforcement. The flaw is classified under CWE-183 (Permissive Allowlist Entry).

Business impact

Organizations using undici for HTTP clients, proxies, or fetch operations that process Set-Cookie headers face a silent degradation of cookie security policies. A malicious or misconfigured upstream server can trick applications into treating cookies with weaker SameSite settings than intended, increasing cross-site request forgery (CSRF) risk. The impact is amplified in proxy or middleware scenarios where applications relay cookies to downstream clients. Since the parsing happens silently without warnings, security assumptions baked into application logic may be violated without detection.

Affected systems

The vulnerability affects all versions of nodejs/undici from 5.15.0 through the unpatched versions in the 6, 7, and 8 release lines. Patches are available in undici v6.26.0, v7.28.0, and v8.5.0. Any application or service using an earlier version of undici that processes Set-Cookie headers—including those using undici's fetch API or proxy functionality—is vulnerable.

Exploitability

Exploitation requires a network position allowing the attacker to respond to HTTP requests as a server (either through DNS hijacking, network compromise, or control of a legitimate upstream service). The attack is deterministic; no user interaction or special conditions are required beyond the application consuming and relying on the parsed cookie. The CVSS score of 3.7 (Low) reflects that impact is limited to integrity of cookie policy enforcement rather than confidentiality or availability, and the attack requires elevated network access. However, the silent nature of the failure means exploitation may go unnoticed.

Remediation

Upgrade undici to v6.26.0, v7.28.0, or v8.5.0 depending on your active release line. Organizations unable to patch immediately should implement validation logic downstream: after undici parses a Set-Cookie header, explicitly verify that the sameSite attribute is one of 'Strict', 'Lax', or 'None' (case-insensitive exact match) before forwarding or acting on the cookie. Reject or log non-conformant values.

Patch guidance

Patched versions are undici v6.26.0, v7.28.0, and v8.5.0. Review your package.json or lock files to identify which release line you are on, then update to the corresponding patched version. Test in a staging environment before production rollout to verify compatibility with your application's HTTP handling. If you maintain a fork or vendored copy of undici, backport the relevant parser fix or apply the workaround validation.

Detection guidance

Monitor Set-Cookie headers in your HTTP traffic or logs for non-standard SameSite values (anything not exactly 'Strict', 'Lax', 'None', or absent). Check your undici version in running processes and dependencies: `npm list undici` or inspect package-lock.json. In proxy or gateway scenarios, log the parsed sameSite values undici produces and alert if they differ from the server's intent. Review application logs for CSRF-related anomalies that might indicate weakened cookie enforcement.

Why prioritize this

Although assigned a Low CVSS score due to limited impact scope (integrity of cookie policy, not confidentiality or availability), this vulnerability should be prioritized if your application relies on SameSite to mitigate CSRF or enforce cookie isolation policies. Priority is highest in gateway, proxy, or server-to-server scenarios where cookie forwarding is common, and in applications that validate security assumptions at parse time. It is lower priority for simple client-side consumers that do not relay cookies or enforce policy based on the parsed attribute.

Risk score, explained

CVSS 3.1 score of 3.7 (Low) reflects: Network attack vector (AV:N), high attack complexity due to need for network control or server position (AC:H), no privilege requirement (PR:N), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L) from silent policy degradation, and no availability impact (A:N). The score appropriately penalizes the attack complexity while acknowledging the integrity risk. However, context matters: in a cookie-centric security model, even low-severity policy violations warrant prompt attention.

Frequently asked questions