CVE-2026-11525

Description

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

CVSS Metrics

• v3.1•LOW•Score: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Trends

Current EPSS score: 0.24%• Percentile: 15%

Techniques & Countermeasures

• CWE-183•Permissive List of Allowed Inputs

  The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Affected Systems

• chainguard•actions-runner

  < 2.335.1-r1

• chainguard•code-server

  < 4.125.0-r2

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.2

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.2

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•gemini-cli

  < 0.49.0-r4

• chainguard•haraka

  < 3.3.1-r1

• chainguard•kibana-8.19

  < 8.19.16-r6

• chainguard•kibana-8.19-bitnami

  < 8.19.16-r6

• chainguard•kibana-8.19-iamguarded

  < 8.19.16-r6

• chainguard•kibana-9.1

  < 9.1.10-r21

• chainguard•kibana-9.1-iamguarded

  < 9.1.10-r21

• chainguard•kibana-9.2

  < 9.2.8-r9

• chainguard•kibana-9.2-iamguarded

  < 9.2.8-r9

• chainguard•kibana-9.3

  < 9.3.5-r4

• chainguard•kibana-9.3-iamguarded

  < 9.3.5-r4

• chainguard•kibana-9.4

  < 9.4.2-r5

• chainguard•kibana-9.4-iamguarded

  < 9.4.2-r5

• chainguard•node-gyp

  < 13.0.0-r1

• chainguard•npm

  < 11.17.0-r1

• chainguard•pelias-api

  < 7.8.0-r4

• chainguard•prism

  < 5.15.11-r3

• chainguard•py3.10-captum

  < 0.9.0-r1

• chainguard•py3.11-captum

  < 0.9.0-r1

• chainguard•py3.12-captum

  < 0.9.0-r1

• chainguard•py3.13-captum

  < 0.9.0-r1

• chainguard•renovate

  < 43.247.0-r0 | < 43.249.5-r2

• chainguard•saf

  < 1.6.0-r2

• chainguard•vitess-24

  < 24.0.2-r1

• chainguard•vitess-24-compat

  < 24.0.3-r7

• wolfi•code-server

  < 4.125.0-r2

• wolfi•node-gyp

  < 13.0.0-r1

• wolfi•npm

  < 11.17.0-r1

• wolfi•prism

  < 5.15.11-r3

• wolfi•renovate

  < 43.247.0-r0 | < 43.249.5-r2

• wolfi•saf

  < 1.6.0-r2

• wolfi•vitess-24

  < 24.0.2-r1

• wolfi•vitess-24-compat

  < 24.0.3-r7

• debian•node-undici

  all | all | < 8.5.0+dfsg+~cs3.2.0-1

• nodejs•undici

  < 6.27.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0

• Npm•undici

  < 6.27.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0

• undici•undici

  < 6.26.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0

References (6)

• https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m
• https://cna.openjsf.org/security-advisories.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-11525
• https://github.com/nodejs/undici
• https://security-tracker.debian.org/tracker/CVE-2026-11525
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11525.json