{"id":"CVE-2026-9679","title":"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding","summary":"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding","severity":"medium","cvss":5.9,"cwe":["CWE-93"],"vendor":"undici","product":"undici","affected":["undici < 6.27.0","undici >= 7.0.0, < 7.28.0","undici >= 8.0.0, < 8.5.0"],"patched":["undici 6.27.0","undici 7.28.0","undici 8.5.0"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-p88m-4jfj-68fv","references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9679"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/advisories/GHSA-p88m-4jfj-68fv"}],"tags":["ghsa","npm"],"epss":0.00257,"epssPercentile":0.1767,"ingestedAt":"2026-06-22T15:59:08.196Z","ecosystem":"npm","slug":"CVE-2026-9679","body":"## Overview\n\n## Impact\n\nundici's cookie parser in `parseSetCookie` percent-decodes cookie values via `qsUnescape`, turning encoded sequences like `%0D%0A`, `%00`, `%3B`, and `%3D` into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a `Set-Cookie` header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary `Set-Cookie`, `Location`, or `Cache-Control` headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.\n\nAffected applications are those that use undici's cookie parsing (`parseSetCookie`, `parseCookie`, `getSetCookies`) and forward the parsed cookie value into a response header.\n\nThis was introduced in undici 7.0.0 via [#3789](https://github.com/nodejs/undici/pull/3789).\n\n## Patches\n\nUpgrade to undici v6.27.0, v7.28.0 or v8.5.0.\n\n## Workarounds\n\nIf upgrade is not immediately possible, do not forward values returned by `parseSetCookie`/`parseCookie`/`getSetCookies` directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, `;`, and `=` bytes.\n\n## Affected packages\n\n- `undici < 6.27.0`\n- `undici >= 7.0.0, < 7.28.0`\n- `undici >= 8.0.0, < 8.5.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `undici 6.27.0`\n- `undici 7.28.0`\n- `undici 8.5.0`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}