CVE-2026-9679Disclosure(nodejs / undici)

LOWCVSS 5.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch nodejs undici systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header. This was introduced in undici 7.0.0 via PR #3789. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

nodejs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-93

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

undici

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 1d ago at 3 mentions (2026-06-17); latest day: 2
5 total mentions across 2 days

Affected systems

Vendors

nodejs

Products

undici

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

240.0%

General

240.0%

Patch

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-17	3	Disclosure1General1Patch1
2026-06-18	2	Disclosure1General1

Full discourse5 posts

Matteo Collina@matteocollina91d
Disclosure
🟡 Moderate: Set-Cookie header injection (CVE-2026-9679). parseSetCookie percent-decoded values, turning `%0D%0A`/`%00` into raw bytes. Forwarding those into response headers → injection, session fixation, open redirects, cache poisoning. v6/v7/v8.
Post summary
The post announces CVE‑2026‑9679, detailing how percent‑decoded characters can inject into Set‑Cookie headers to cause session fixation, open redirects, and cache poisoning, but it offers no PoC, exploit, or patch information.
10020281
57.8K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-9679 HTTP Response Header Injection in Undici Cookie Parser via Percent-Decoding https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9679
Post summary
CVE-2026-9679 is identified as an HTTP Response Header Injection vulnerability in the Undici Cookie Parser using percent-decoding; no PoC, exploit, patch, or active exploitation details are provided.
0000045
4.1K followersView on X
Infoflowcloud@infoflowcloud92d
General
🚨*CVE* CVE-2026-9679 Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their liter… https://www.cve.org/CVERecord?id=CVE-2026-9679 ----- Traducción: Impacto de CVE-20… http://infoflow.cloud`
Post summary
The post lists CVE-2026‑9679, describing the affected module and decoding behavior, but offers no proof of exploitation, tools, or remediation steps.
0000033
82 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-9679 Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their liter… https://www.cve.org/CVERecord?id=CVE-2026-9679
Post summary
The post announces CVE‑2026‑9679, noting that undici’s cookie parser incorrectly percent‑decodes cookie values, potentially leading to injection vulnerabilities. No proof‑of‑concept, active exploitation, or patch details are provided.
00000179
57.6K followersView on X
Ulises Gascón@kom_25692d
Patch
🚨 Medium-severity security fix in undici (6.26.0, 7.28.0, 8.5.0) just released! Patches CVE-2026-9679. undici vulnerable to HTTP header injection via Set-Cookie percent-decoding. https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv
Post summary
The advisory announces a medium‑severity security fix for CVE‑2026‑9679 affecting undici, specifying the vulnerability as an HTTP header injection via percent‑decoded Set‑Cookie headers, and lists the patched versions.
0000091
5.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nodejs	undici	-	node.js	-

Explore more

Back to dashboard nodejs CVEs undici vulnerabilities

What researchers are saying

CVE-2026-9679

Matteo Collina[verified]@matteocollinaDisclosure

The post announces CVE‑2026‑9679, detailing how percent‑decoded characters can inject into Set‑Cookie headers to cause session fixation, open redirects, and cache poisoning, but it offers no PoC, exploit, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

CVE-2026-9679 is identified as an HTTP Response Header Injection vulnerability in the Undici Cookie Parser using percent-decoding; no PoC, exploit, patch, or active exploitation details are provided.

Infoflowcloud@infoflowcloudGeneral

The post lists CVE-2026‑9679, describing the affected module and decoding behavior, but offers no proof of exploitation, tools, or remediation steps.

CVE@CVEnewDisclosure

The post announces CVE‑2026‑9679, noting that undici’s cookie parser incorrectly percent‑decodes cookie values, potentially leading to injection vulnerabilities. No proof‑of‑concept, active exploitation, or patch details are provided.

Ulises Gascón@kom_256Patch

The advisory announces a medium‑severity security fix for CVE‑2026‑9679 affecting undici, specifying the vulnerability as an HTTP header injection via percent‑decoded Set‑Cookie headers, and lists the patched versions.