Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-17 | 2 | Disclosure1Patch1 |
| 2026-06-18 | 1 | Disclosure1 |
🔵 Low: SameSite downgrade (CVE-2026-11525). Substring matching meant `SameSite=NoneOfYourBusiness` parsed as `None` and `StrictLax` as `Lax`, silently weakening cookie policies. v6/v7/v8.
Post summary
The post announces CVE‑2026‑11525, a low‑severity SameSite downgrade flaw caused by substring parsing errors that weaken cookie policies in versions 6‑8; no PoC, exploit, patch, or active exploitation is mentioned.
CVE-2026-11525 Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insens… https://www.cve.org/CVERecord?id=CVE-2026-11525
Post summary
CVE-2026-11525 is a disclosed vulnerability in undici where Set-Cookie parsing accepts SameSite values containing the substrings 'Strict', 'Lax', or 'None', potentially weakening cookie security.
🚨 Low-severity security fix in undici (6.26.0, 7.28.0, 8.5.0) just released! Patches CVE-2026-11525. undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching. https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m
Post summary
A low‑severity patch for undici (v6.26.0, 7.28.0, 8.5.0) addresses CVE‑2026‑11525, a Set‑Cookie SameSite downgrade issue, now available through the Node.js security advisory.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodejs | undici | - | node.js | - |