CVE-2026-11525: Undici SameSite Parsing Vulnerability

CVE-2026-11525 Overview

CVE-2026-11525 affects undici, the HTTP/1.1 client used by Node.js fetch and proxy code paths. The library improperly parses the SameSite attribute of Set-Cookie headers. Instead of requiring a case-insensitive exact match against Strict, Lax, or None as specified by RFC 6265, undici accepts any value containing one of those tokens as a substring. Non-spec values map silently to one of the three standard tokens, which can downgrade cookie enforcement. The flaw was introduced in undici 5.15.0 when the cookies feature was added.

Critical Impact
A malicious or non-compliant server can coerce a consumer's view of a cookie's SameSite policy to a weaker value, silently degrading SameSite enforcement and weakening cross-site request protections.

Affected Products

undici versions 5.15.0 through versions prior to 6.26.0
undici 7.x prior to 7.28.0
undici 8.x prior to 8.5.0

Discovery Timeline

2026-06-17 - CVE-2026-11525 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11525

Vulnerability Analysis

The vulnerability is an input validation flaw classified under [CWE-183] (Permissive List of Allowed Inputs). When undici parses a Set-Cookie response header, its SameSite attribute parser performs a substring match rather than an exact, case-insensitive comparison. Any token containing Strict, Lax, or None is silently coerced into the matching standard value. For example, SameSite=NoneOfYourBusiness is parsed as None, the most permissive setting. Similarly, SameSite=StrictLax is parsed as Lax, downgrading enforcement from Strict. Applications that consume parsed cookies through undici's fetch API or proxy code paths then forward or rely on the weakened attribute, breaking the security guarantees the cookie's issuer intended.

Root Cause

The parsing routine added to undici 5.15.0 uses a permissive substring containment check instead of an exact token match. RFC 6265bis defines SameSite values as a closed set of three tokens compared case-insensitively. Undici's implementation does not enforce that closed set, so attacker-controlled or non-compliant server values pass validation and are normalized to a standard token. The flaw lies in the SameSite attribute branch of the Set-Cookie parser shipped with the cookies feature.

Attack Vector

Exploitation requires a malicious or non-compliant upstream server whose Set-Cookie response is consumed by an undici-based client. The attacker crafts a SameSite value such as SameSite=NoneOfYourBusiness that embeds one of the standard tokens as a substring. When the client parses the header and forwards the cookie, or makes authorization decisions based on the parsed sameSite field, the downstream consumer treats the cookie as having the weaker policy. This is most impactful in proxy and gateway code paths where parsed cookies are re-emitted to browsers or other clients. See the GitHub Security Advisory GHSA-g8m3-5g58-fq7m for full technical detail.

No public proof-of-concept exploit code is referenced in the advisory. The vulnerability mechanism is described in prose above; refer to the upstream advisory for parser specifics.

Detection Methods for CVE-2026-11525

Indicators of Compromise

Set-Cookie response headers containing non-standard SameSite values that embed Strict, Lax, or None as substrings, such as SameSite=NoneOfYourBusiness or SameSite=StrictLax.
Outbound cookies emitted by an undici-based proxy whose SameSite attribute differs from the original upstream value.
Application logs showing parsed sameSite fields equal to None or Lax when the upstream header value was non-spec.

Detection Strategies

Inspect HTTP response traffic at the proxy or gateway layer for SameSite attribute values that are not an exact case-insensitive match for Strict, Lax, or None.
Audit Node.js application dependencies for undici versions between 5.15.0 and the patched releases, including transitive dependencies pulled in by fetch-using libraries.
Add unit tests that feed crafted Set-Cookie headers into the application's cookie consumption path and assert rejection of non-standard SameSite tokens.

Monitoring Recommendations

Monitor egress cookies from Node.js services and proxies for SameSite values that have been silently normalized.
Track npm ls undici output across the fleet to identify services running affected versions.
Alert on any modification of SameSite policy between upstream and downstream HTTP responses in proxy logs.

How to Mitigate CVE-2026-11525

Immediate Actions Required

Upgrade undici to version 6.26.0, 7.28.0, or 8.5.0 as appropriate for your major version line.
Identify and update applications that depend on undici transitively through Node.js fetch, Agent, or proxy libraries.
Re-deploy any proxy or gateway service that parses and forwards Set-Cookie headers received from third-party origins.

Patch Information

The maintainers released fixes in undici v6.26.0, v7.28.0, and v8.5.0. Patched parsers enforce an exact, case-insensitive match of the SameSite attribute against the RFC 6265bis token set. Details are published in the GitHub Security Advisory GHSA-g8m3-5g58-fq7m and the OpenJSF Security Advisories listing.

Workarounds

After parsing a Set-Cookie header, validate that the resulting sameSite value is exactly one of Strict, Lax, or None using a case-insensitive comparison before forwarding or relying on it.
Reject or drop cookies whose SameSite attribute does not match the closed token set, rather than normalizing them.
For proxy code paths, preserve the original Set-Cookie byte sequence end-to-end instead of re-emitting a parsed representation.

bash

# Upgrade undici to a patched release
npm install undici@^6.26.0
# or
npm install undici@^7.28.0
# or
npm install undici@^8.5.0

# Verify the resolved version across the dependency tree
npm ls undici