HTTP Response Header Injection Vulnerability in Undici Product by Node.js

CVE-2026-9679

What is CVE-2026-9679?

In the latest versions of Undici, the cookie parser (parseSetCookie) improperly decodes cookie values, which can expose applications to HTTP response header injection vulnerabilities. This issue arises when applications parse Set-Cookie headers and forward those parsed values into response headers. Malicious upstream actors can exploit this flaw to inject arbitrary headers such as Set-Cookie, Location, or Cache-Control, potentially leading to serious security threats like session fixation, open redirects, or cache poisoning. Developers using Undici are advised to upgrade to versions 6.26.0, 7.28.0, or 8.5.0, or implement proper sanitation of cookie values before forwarding them in response headers.

References