CVE-2026-11525: undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
Impact
When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens:
- SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting. - SameSite=StrictLax is parsed as Lax, a downgrade from Strict.
Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.
This was introduced in undici 5.15.0 when the cookies feature was added.
Patches
Upgrade to undici v6.27.0, v7.28.0 or v8.5.0.
Workarounds
After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
Other sources
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).
Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.
This was introduced in undici 5.15.0 when the cookies feature was added.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
— MITRE
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 6.27.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0-2 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.26.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.28.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.5.0 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 6.27.0 - Configuration
After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it; this prevents substring values (e.g., 'NoneOfYourBusiness' → parsed as None; 'StrictLax' → parsed as Lax) from being silently accepted/downgraded.
undici Set-Cookie SameSite parsing SameSite attribute validation = Strict|Lax|None (exact, case-insensitive)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11525?
The severity of CVE-2026-11525 is rated low, with a score of 3.7.
What is the impact of CVE-2026-11525?
CVE-2026-11525 allows undici to interpret non-standard SameSite attribute values as valid, which may lead to unintended cookie behaviors.
How does CVE-2026-11525 affect cookie security?
CVE-2026-11525 can undermine cookie security by permitting substring matches for SameSite attributes, leading to potential downgrades in cookie handling.
How do I fix CVE-2026-11525?
To fix CVE-2026-11525, ensure that the undici library is updated to a version that correctly implements RFC 6265 for SameSite attribute values.
Who is affected by CVE-2026-11525?
Developers using the undici library for HTTP requests in their applications may be affected by CVE-2026-11525.