Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).
Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.
This was introduced in undici 5.15.0 when the cookies feature was added.
Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade v8-12.4-develUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemon | Jul 7, 2026 | Jul 6, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-develUpgrade nodejs24-npmUpgrade v8-12.4-develUpgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs22-libs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs22-npmUpgrade v8-13.6-develUpgrade nodejs22-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs24Upgrade nodejs22-debuginfoUpgrade nodejs24-libsUpgrade nodejs22Upgrade nodejs24-develUpgrade nodejs22-full-i18nUpgrade nodejs22-docsUpgrade nodejs24-debugsource | Jul 8, 2026 | Jun 17, 2026 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs-packagingUpgrade nodejsNo solution existsUpgrade nodejs24-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs24-debugsourceUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-npmUpgrade nodejs24-libsUpgrade nodejs24-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs24-develUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs24-npmUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfo | Jul 7, 2026 | Jun 17, 2026 |
| Rocky_linux | — | Upgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs24Upgrade nodejs-debugsourceUpgrade nodejs24-debuginfoUpgrade nodejs24-libsUpgrade v8-12.4-develUpgrade npmUpgrade nodejs22-debugsourceUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade v8-13.6-develUpgrade nodejs-npmUpgrade nodejs22-debuginfoUpgrade nodejs-libs | Jul 10, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub