CLEANSTART-2026-VQ20576: undici's setCookie function does not fully sanitize cookie attributes
Published Nov 7, 2026
·Updated
Security vulnerability affects the npm package. undici's setCookie function does not fully sanitize cookie attributes.
Affected Software
1 affected componentFixes available
cleanstart/npm<12.0.1-r1
12.0.1-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/npmto a version that resolves this vulnerability.Fixed in 12.0.1-r1
Event History
Nov 7, 2026
Advisory Published
via OSV·12:35 AM
Data Sourced
via OSV·12:35 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does the available advisory identify affected or fixed package versions?
No affected or fixed versions are provided in the available data.
2
Does the available information state whether default configurations are affected or describe exploitation prerequisites?
No. The data does not specify configuration requirements, attacker prerequisites, or exposure conditions.
3
Is a workaround or mitigation provided for environments that cannot patch immediately?
No workaround or mitigation is included in the available data.