CVE-2026-9679: Undici Auth Bypass Vulnerability

CVE-2026-9679 Overview

CVE-2026-9679 is an HTTP response header injection vulnerability in undici, the HTTP/1.1 client used by Node.js. The flaw resides in the parseSetCookie function, which percent-decodes cookie values through qsUnescape. This behavior converts encoded sequences such as %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 specifies no such decoding, and browsers do not perform it either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header become susceptible to header injection. The issue was introduced in undici 7.0.0 via PR #3789 and is tracked under [CWE-93] (Improper Neutralization of CRLF Sequences).

Critical Impact
Attacker-controlled upstream servers can inject arbitrary Set-Cookie, Location, or Cache-Control headers into a downstream response, enabling session fixation, open redirect, and cache poisoning.

Affected Products

undici 7.0.0 through versions prior to 7.28.0
undici 6.x prior to 6.26.0
undici 8.x prior to 8.5.0

Discovery Timeline

2026-06-17 - CVE-2026-9679 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-9679

Vulnerability Analysis

The vulnerability stems from undici's parseSetCookie implementation invoking qsUnescape on the cookie value. qsUnescape performs percent-decoding identical to URL query string handling, which is not appropriate for cookie semantics. Decoded bytes can include CR (\r), LF (\n), NUL (\0), semicolon (;), and equals (=) characters. When the parsed value is reflected into a downstream response header by a proxy, middleware layer, or server-side rendering framework, injected CRLF sequences split the header context. The attacker effectively appends additional response headers or even a new response body. The same primitive can also smuggle cookie attribute delimiters via decoded ; and = bytes.

Root Cause

The root cause is non-compliant decoding behavior introduced in undici 7.0.0. RFC 6265 treats cookie-value octets as opaque and does not authorize percent-decoding. By applying qsUnescape to the value, undici transforms an inert, encoded payload from an upstream server into a live byte stream containing header-significant control characters.

Attack Vector

Exploitation requires an attacker to control an upstream HTTP response that the vulnerable application fetches with undici. The attacker sets a Set-Cookie header containing percent-encoded CRLF or delimiter bytes. The application parses the cookie with parseSetCookie, parseCookie, or getSetCookies, then forwards the decoded value into its own response. The injected CRLF terminates the current header and allows the attacker to introduce arbitrary Set-Cookie, Location, or Cache-Control headers, leading to session fixation, open redirects to attacker-controlled domains, or poisoning of intermediary caches.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-p88m-4jfj-68fv for additional technical detail.

Detection Methods for CVE-2026-9679

Indicators of Compromise

Outbound HTTP responses containing Set-Cookie values with percent-encoded %0D, %0A, %00, %3B, or %3D sequences.
Application response headers containing unexpected duplicate Set-Cookie, Location, or Cache-Control entries originating from a single upstream call.
Unexpected redirects to external domains following requests that traverse an undici-based proxy or middleware.

Detection Strategies

Inventory Node.js services and identify those using undici versions 7.0.0 through 7.27.x, 6.x prior to 6.26.0, or 8.x prior to 8.5.0.
Perform static analysis to locate call sites that pass values from parseSetCookie, parseCookie, or getSetCookies into response header APIs such as res.setHeader or framework equivalents.
Add runtime assertions in middleware to reject outbound header values containing CR, LF, or NUL bytes.

Monitoring Recommendations

Log and alert on response headers emitted by Node.js services that contain control characters or unexpected duplicates.
Monitor upstream API responses for Set-Cookie values containing percent-encoded delimiter or control bytes.
Track package manifests in CI/CD pipelines for vulnerable undici versions and fail builds when detected.

How to Mitigate CVE-2026-9679

Immediate Actions Required

Upgrade undici to v6.26.0, v7.28.0, or v8.5.0 depending on the major version in use.
Audit application code for direct forwarding of parsed cookie values into response headers and add sanitization at those sites.
Pin transitive undici dependencies via lockfile overrides to ensure the patched version is resolved.

Patch Information

The maintainers fixed the issue by removing the inappropriate percent-decoding step from the cookie value parser. Patched releases are undici v6.26.0, v7.28.0, and v8.5.0. See the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-p88m-4jfj-68fv for release details.

Workarounds

Do not forward values returned by parseSetCookie, parseCookie, or getSetCookies directly into response headers.
Sanitize parsed cookie values before reuse by stripping or rejecting CR (\r), LF (\n), NUL (\0), ;, and = bytes.
Where feasible, replace undici-based cookie parsing with a parser that complies with RFC 6265 and treats the cookie value as opaque.

bash

# Upgrade to a patched undici release
npm install undici@8.5.0
# or
npm install undici@7.28.0
# or
npm install undici@6.26.0