Executive brief
Undici is a popular HTTP client for Node.js used to fetch data and manage web requests. A flaw in how it handles security settings for cookies allows a malicious server to trick the application into using weaker security protections than intended. This could lead to cookies being sent in contexts where they should be restricted, potentially weakening the overall security posture of the application.
Technical details
Undici's cookie parsing logic fails to perform case-insensitive exact matches for the SameSite attribute as required by RFC 6265. Instead, it accepts any value containing 'Strict', 'Lax', or 'None' as a substring and maps it to the corresponding standard token. For example, 'SameSite=NoneOfYourBusiness' is incorrectly parsed as 'None'. An attacker-controlled or non-compliant server can exploit this to coerce an application into adopting a weaker SameSite policy than intended. This vulnerability affects applications using undici's fetch or proxy paths that forward or rely on parsed cookie attributes. Patches are available in versions 6.27.0, 7.28.0, and 8.5.0.
Affected products
- Node.js undici >= 5.15.0, < 6.27.0; >= 7.0.0, < 7.28.0; >= 8.0.0, < 8.5.0
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched