Cookie Handling Vulnerability in Undici Library by Node.js

CVE-2026-11525

What is CVE-2026-11525?

The vulnerability in the Undici library allows for improper processing of the Set-Cookie header. Specifically, the library does not enforce a case-insensitive exact match for the SameSite attribute, as dictated by RFC 6265. Instead, it accepts any substring that contains 'Strict', 'Lax', or 'None', mapping non-compliant values to these standard categories. This means a malicious server could manipulate a cookie's SameSite policy, potentially reducing the security intended by the developer. Applications relying on parsed SameSite values may unintentionally expose users to risks by accepting less stringent SameSite settings through faulty parsing of cookie headers.

References