CVE-2026-9679 Details
Description
Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header. This was introduced in undici 7.0.0 via PR #3789. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.
A vulnerability in the undici HTTP client library allows for HTTP header injection through improper parsing of Set-Cookie values. The cookie parser in undici versions prior to 6.26.0, between 7.0.0 and 7.28.0, and between 8.0.0 and 8.5.0 percent-decodes cookie values in a way that introduces CRLF sequences and other control characters. This behavior, not aligned with RFC 6265, can be exploited by applications that forward parsed cookie values into response headers, such as proxies, middleware, and server-side rendering frameworks. The vulnerability enables an attacker to inject arbitrary Set-Cookie, Location, or Cache-Control headers, potentially leading to session fixation, open redirect, or cache poisoning attacks.
Users are advised to upgrade to undici versions 6.26.0, 7.28.0, or 8.5.0. If an immediate upgrade is not possible, do not forward values from undici's cookie parsing functions directly into response headers. Instead, sanitize the values to remove or reject any carriage return, line feed, null byte, semicolon, or equals sign.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv | openjs | Vendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | openjs |
Affected Products
| Product | Versions |
|---|---|
| nodejs undici | < 6.27.0 >= 7.0.0, < 7.28.0 >= 8.0.0, < 8.5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | openjs |