[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-11525":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":35,"aliases":36,"duplicate_of":9,"upstream":38,"downstream":39,"duplicates":72,"related":73,"reserved_at":9,"published_at":84,"modified_at":85,"state":86,"summary":87,"references_raw":95,"kevs":116,"epss":117,"epss_history":120,"metrics":173,"affected":181},"CVE-2026-11525","Impact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.\n\nThis was introduced in undici 5.15.0 when the cookies feature was added.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nAfter parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-183","Permissive List of Allowed Inputs","The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.","weakness","Draft","Base",[19,23,27,31],{"id":20,"name":21,"techniques":22},"CAPEC-120","Double Encoding",[],{"id":24,"name":25,"techniques":26},"CAPEC-3","Using Leading 'Ghost' Character Sequences to Bypass Input Filters",[],{"id":28,"name":29,"techniques":30},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":32,"name":33,"techniques":34},"CAPEC-71","Using Unicode Encoding to Bypass Validation Logic",[],[],[37],"GHSA-g8m3-5g58-fq7m",[],[40,42,44,46,48,50,52,54,56,58,60,62,64,66,68,70],{"_key":41},"UBUNTU-CVE-2026-11525",{"_key":43},"SUSE-SU-2026:2633-1",{"_key":45},"OPENSUSE-SU-2026:11121-1",{"_key":47},"SUSE-SU-2026:2647-1",{"_key":49},"DEBIAN-CVE-2026-11525",{"_key":51},"SUSE-SU-2026:22368-1",{"_key":53},"SUSE-SU-2026:2695-1",{"_key":55},"OPENSUSE-SU-2026:21058-1",{"_key":57},"OPENSUSE-SU-2026:21236-1",{"_key":59},"SUSE-SU-2026:22565-1",{"_key":61},"RHSA-2026:35841",{"_key":63},"RHSA-2026:35842",{"_key":65},"RHSA-2026:35891",{"_key":67},"RHSA-2026:35892",{"_key":69},"RHSA-2026:38236",{"_key":71},"RHSA-2026:39868",[],[74,75,76,77,78,79,80,81,82],{"_key":43},{"_key":45},{"_key":47},{"_key":51},{"_key":53},{"_key":55},{"_key":57},{"_key":59},{"_key":83},"CGA-2RP4-X4W5-V2X2","2026-06-17T17:31:03.163Z","2026-06-17T17:54:22.022Z","PUBLISHED",{"cisa_kev":88,"cisa_ransomware":88,"cisa_vendor":9,"epss_severity":89,"epss_score":90,"severity":89,"severity_score":91,"severity_version":92,"severity_source":93,"severity_vector":94,"severity_status":86},false,"low",0.00248,3.7,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",[96,102,106,111],{"url":97,"sources":98,"tags":100},"https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m",[93,99],"osv_npm",[101],"WEB",{"url":103,"sources":104,"tags":105},"https://cna.openjsf.org/security-advisories.html",[93,99],[101],{"url":107,"sources":108,"tags":109},"https://nvd.nist.gov/vuln/detail/CVE-2026-11525",[99],[110],"Advisory",{"url":112,"sources":113,"tags":114},"https://github.com/nodejs/undici",[99],[115],"PACKAGE",[],{"date":118,"score":90,"percentile":119},"2026-07-05",0.15944,[121,125,128,131,134,137,140,143,146,149,152,155,157,160,163,166,169,172],{"date":122,"score":123,"percentile":124},"2026-06-18",0.00197,0.0961,{"date":126,"score":123,"percentile":127},"2026-06-19",0.09583,{"date":129,"score":123,"percentile":130},"2026-06-20",0.09571,{"date":132,"score":123,"percentile":133},"2026-06-21",0.09562,{"date":135,"score":123,"percentile":136},"2026-06-22",0.09555,{"date":138,"score":90,"percentile":139},"2026-06-23",0.15771,{"date":141,"score":90,"percentile":142},"2026-06-24",0.15793,{"date":144,"score":90,"percentile":145},"2026-06-25",0.1589,{"date":147,"score":90,"percentile":148},"2026-06-26",0.15912,{"date":150,"score":90,"percentile":151},"2026-06-27",0.1595,{"date":153,"score":90,"percentile":154},"2026-06-28",0.15916,{"date":156,"score":90,"percentile":148},"2026-06-29",{"date":158,"score":90,"percentile":159},"2026-06-30",0.15905,{"date":161,"score":90,"percentile":162},"2026-07-01",0.15995,{"date":164,"score":90,"percentile":165},"2026-07-02",0.15928,{"date":167,"score":90,"percentile":168},"2026-07-03",0.15929,{"date":170,"score":90,"percentile":171},"2026-07-04",0.15934,{"date":118,"score":90,"percentile":119},[174,179],{"source":93,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":175,"cvss_v4_0":9},{"baseScore":91,"baseSeverity":176,"vectorString":94,"impactScore":177,"exploitabilityScore":178},"LOW",2.3,5.6,{"source":99,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":180,"cvss_v4_0":9},{"baseScore":91,"baseSeverity":9,"vectorString":94,"impactScore":177,"exploitabilityScore":178},[182,202],{"ecosystem":183,"name":184,"vendor":183,"product":184,"cpe_part":9,"purl_type":185,"purl_namespace":9,"purl_name":184,"source":9,"versions":186},"Npm","undici","npm",[187,193,198],{"version":188,"is_range":189,"range_type":190,"version_start":9,"version_start_type":9,"version_end":191,"version_end_type":192,"fixed_in":9},"lt6_27_0",true,"semver","6.27.0","excluding",{"version":194,"is_range":189,"range_type":190,"version_start":195,"version_start_type":196,"version_end":197,"version_end_type":192,"fixed_in":9},"gte7_0_0_lt7_28_0","7.0.0","including","7.28.0",{"version":199,"is_range":189,"range_type":190,"version_start":200,"version_start_type":196,"version_end":201,"version_end_type":192,"fixed_in":9},"gte8_0_0_lt8_5_0","8.0.0","8.5.0",{"ecosystem":9,"name":184,"vendor":184,"product":184,"cpe_part":203,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":204},"a",[205,208,210],{"version":206,"is_range":189,"range_type":93,"version_start":9,"version_start_type":9,"version_end":207,"version_end_type":192,"fixed_in":9},"\u003C 6.26.0","6.26.0",{"version":209,"is_range":189,"range_type":93,"version_start":195,"version_start_type":196,"version_end":197,"version_end_type":192,"fixed_in":9},">= 7.0.0, \u003C 7.28.0",{"version":211,"is_range":189,"range_type":93,"version_start":200,"version_start_type":196,"version_end":201,"version_end_type":192,"fixed_in":9},">= 8.0.0, \u003C 8.5.0"]