CVE-2026-9679: Undici Cookie Parser HTTP Header Injection Vulnerability

Technical summary

Undici's parseSetCookie and related functions apply percent-decoding (qsUnescape) to cookie values, converting encoded sequences such as %0D%0A (carriage return + line feed), %00 (null), %3B (semicolon), and %3D (equals) into their literal byte equivalents. RFC 6265 §5.4, the HTTP State Management Mechanism standard, specifies no such decoding, and browsers do not perform this decoding either. When applications parse a Set-Cookie header from an upstream response and forward the decoded cookie value directly into their own response headers without sanitization, an attacker controlling the upstream can craft a malicious cookie value containing encoded newlines and special characters that, once decoded by undici and echoed into the response, become literal control characters. This breaks the HTTP header boundary and allows injection of entirely new headers. The root cause was introduced in undici 7.0.0 via PR #3789.

Business impact

This vulnerability poses a session security and cache integrity risk for any organization running applications that proxy or middleware HTTP traffic using undici. Session fixation attacks allow attackers to pre-set victim sessions, potentially escalating to account takeover. Open redirect vulnerabilities can be weaponized in phishing campaigns. Cache poisoning affects content delivery networks and reverse proxies, allowing attackers to serve malicious content to all downstream users. Organizations using undici in production—particularly those in ecommerce, SaaS, and content delivery—face both direct exploitation risk and reputational damage if poisoned responses reach end users.

Affected systems

The vulnerability affects undici versions 7.0.0 through 7.27.x (pending v7.28.0 patch) and 8.0.0 through 8.4.x (pending v8.5.0 patch). Undici 6.x versions remain unaffected. Any Node.js application or framework using undici's cookie parsing functions (parseSetCookie, parseCookie, getSetCookies) is potentially affected if those parsed values are forwarded into response headers. This includes Next.js and other SSR frameworks, API proxies, and middleware that rely on undici for HTTP handling.

Exploitability

Exploitation requires two conditions: an application must parse Set-Cookie headers using undici and forward the parsed cookie value into a response header without sanitization. The attacker must control or influence the upstream Set-Cookie response—typically via a compromised or attacker-controlled API, or via an open redirect in a trusted service. The CVSS score of 5.9 (MEDIUM) reflects the high impact (response header injection) but assumes the attacker lacks direct access and the vulnerable code path must be present and actively used. Real-world exploitability depends on deployment context; applications that proxy user-supplied URLs or trust upstream APIs are at higher risk.

Remediation

Upgrade undici immediately: to v6.26.0 for LTS users, v7.28.0 for stable users, or v8.5.0 for bleeding-edge users. Verify your package.json and dependency tree for undici versions and apply the appropriate patch. If immediate upgrade is infeasible, implement input sanitization on all cookie values returned by undici before forwarding them into response headers; explicitly strip or reject CR (\r), LF (\n), NUL (\0), semicolon (;), and equals (=) bytes. This is a temporary workaround only and does not address the underlying design flaw.

Patch guidance

Patches are available in undici v6.26.0, v7.28.0, and v8.5.0. Determine which version line your application depends on and upgrade accordingly. Most Node.js projects should target v8.5.0 unless constrained to LTS or specific compatibility requirements. After upgrading, run your application's test suite to confirm no regressions, then deploy to staging to validate behavior with real upstream services before rolling to production. Monitor your package management tools (npm, yarn) for any additional undici advisories during rollout.

Detection guidance

Review your application logs for unusual Set-Cookie, Location, or Cache-Control headers in outbound responses, particularly those containing newlines or special characters. If your application proxies HTTP traffic, inspect upstream responses before they are forwarded downstream. Check for undici version usage via `npm ls undici` and cross-reference against the affected version ranges (7.0.0–7.27.x, 8.0.0–8.4.x). Runtime monitoring for header injection patterns—detecting CR/LF bytes in response header values—can catch exploitation attempts. Consider adding a lint rule or pre-deployment check that flags code paths forwarding parseSetCookie output directly into response headers without sanitization.

Why prioritize this

Although the CVSS score is MEDIUM (5.9), this vulnerability warrants HIGH prioritization because it affects a widely used library in the Node.js ecosystem and enables header injection—a gateway vulnerability for session attacks and cache poisoning. Many organizations use undici indirectly through frameworks or proxies without realizing it. The fix is straightforward (version bump), so rapid patching is feasible and should be prioritized for any production services handling authentication or sensitive content.

Risk score, explained

CVSS 5.9 (MEDIUM) is assigned because the vulnerability has network-adjacent attack complexity (an attacker must control or influence an upstream response), requires no user interaction, and yields high integrity impact (response header injection) but no confidentiality or availability impact. The score does not fully capture the downstream business risk—session hijacking and cache poisoning are high-impact attack vectors—which is why manual risk assessment and prioritization should supplement the CVSS score in organizational context.

Frequently asked questions