Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).
Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.
This was introduced in undici 5.15.0 when the cookies feature was added.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-devel | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-libs-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs24-npmUpgrade nodejs22-develUpgrade nodejs22-npmUpgrade v8-12.4-develUpgrade nodejs22-libsUpgrade v8-13.6-develUpgrade nodejs22Upgrade nodejs22-full-i18nUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs22-docs | Jul 8, 2026 | Jun 17, 2026 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs24Upgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs24-docsUpgrade nodejs24-develUpgrade nodejsUpgrade nodejs-develUpgrade nodejs24-npmUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade npmUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs24-libs | Oct 22, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs24Upgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejs-packagingUpgrade nodejs24-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-libsUpgrade nodejs-nodemonUpgrade nodejs22-debugsourceUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs24-npmUpgrade npmUpgrade nodejs24-develUpgrade nodejs-npm | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs24-debuginfoUpgrade nodejs-debugsourceUpgrade v8-12.4-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs-npmUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18n | Jul 10, 2026 | Jul 7, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub