Description
Impact:
undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.
Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.
Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.
This was introduced in undici 7.0.0 via PR #3789.
Patches:
Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.
Workarounds:
If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| undici | undici | < 6.26.0, 7.0.0 – < 7.28.0, 8.0.0 – < 8.5.0 | 6.26.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-undici | 8.5.0+dfsg+~cs3.2.0-1 | — |
| Debian 13 | node-undici | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-undici | No fix yet | — |
| Ubuntu 26.04 LTS | node-undici | No fix yet | — |
| Ubuntu 25.10 | node-undici | No fix yet | — |
| Ubuntu 24.04 LTS | node-undici | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.18.0-0.3.hum1 | RHSA-2026:38236 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.16.0-1.24.18.0.0.3.hum1 | RHSA-2026:38236 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.5.0-1.3.hum1 | RHSA-2026:38009 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.17.0-1.26.5.0.1.3.hum1 | RHSA-2026:38009 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 13.6.233.17-1.24.18.0.0.3.hum1 | RHSA-2026:38236 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | nodejs22 | 22.23.0-150700.3.12.1 | SUSE-SU-2026:2695-1 |
| SLES 15 SP7 | nodejs24 | 24.17.0-150700.15.11.1 | SUSE-SU-2026:2633-1 |
| SLES 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES 15 SP6 | nodejs22 | 22.23.0-150600.13.18.1 | SUSE-SU-2026:2647-1 |
| SLES 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLES 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 12 SP5 | nodejs18 | 18.20.8-8.44.1 | SUSE-SU-2026:4248-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | nodejs22 | 22.23.0-160000.1.1 | SUSE-SU-2026:22368-1 |
| SLES for SAP 16.0 | nodejs24 | 24.18.0-160000.1.1 | SUSE-SU-2026:22565-1 |
| SLES for SAP 15 SP6 | nodejs20 | 20.20.2-150600.3.21.1 | SUSE-SU-2026:3929-1 |
| SLES for SAP 15 SP6 | nodejs22 | 22.23.0-150600.13.18.1 | SUSE-SU-2026:2647-1 |
| SLES for SAP 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES for SAP 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLES for SAP 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLES 16.0 | nodejs22 | 22.23.0-160000.1.1 | SUSE-SU-2026:22368-1 |
| SLES 16.0 | nodejs24 | 24.18.0-160000.1.1 | SUSE-SU-2026:22565-1 |
| SLE HPC 15 SP5 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
| SLE HPC 15 SP5 | nodejs20 | 20.20.2-150500.11.30.1 | SUSE-SU-2026:3930-1 |
| SLE HPC 15 SP4 | nodejs18 | 18.20.8-150400.9.39.1 | SUSE-SU-2026:4261-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nodejs24 | 24.17.0-1.1 | openSUSE-SU-2026:11121-1 |
| openSUSE Leap 16.0 | nodejs22 | 22.23.0-160000.1.1 | openSUSE-SU-2026:21058-1 |
| openSUSE Leap 16.0 | nodejs24 | 24.18.0-160000.1.1 | openSUSE-SU-2026:21236-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.1-1.amzn2023.0.1 | ALAS2023-2026-1921 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.8-1.22.23.1.1.amzn2023.0.1 | ALAS2023-2026-1921 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.18.0-1.amzn2023.0.1 | ALAS2023-2026-1920 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.amzn2023.0.1 | ALAS2023-2026-1920 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.1.amzn2023.0.1 | ALAS2023-2026-1921 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.amzn2023.0.1 | ALAS2023-2026-1920 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs | 24.18.1-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.125.0-r2 | — |
| Wolfi rolling | node-gyp | 13.0.0-r1 | — |
| Wolfi rolling | npm | 11.17.0-r1 | — |
| Wolfi rolling | prism | 5.15.11-r3 | — |
| Wolfi rolling | renovate | 43.247.0-r0 | — |
| Wolfi rolling | saf | 1.6.0-r2 | — |
| Wolfi rolling | vitess-24 | 24.0.2-r1 | — |
| Wolfi rolling | vitess-24-compat | 24.0.3-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | undici | < 6.27.0 | 6.27.0 | GHSA-p88m-4jfj-68fv |
| npm | undici | >= 7.0.0, < 7.28.0 | 7.28.0 | GHSA-p88m-4jfj-68fv |
| npm | undici | >= 8.0.0, < 8.5.0 | 8.5.0 | GHSA-p88m-4jfj-68fv |
Advisories 17
- RHSA-2026:38236 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:38009 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2618 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- SUSE-SU-2026:4261-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
- SUSE-SU-2026:4248-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Sep 18, 2026
- SUSE-SU-2026:3929-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- SUSE-SU-2026:3930-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Sep 10, 2026
- ALAS2023-2026-1920 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 24, 2026
- SUSE-SU-2026:22565-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:21236-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Jul 9, 2026
- ALAS2023-2026-1921 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- SUSE-SU-2026:22368-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jul 2, 2026
- SUSE-SU-2026:2695-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jul 1, 2026
- openSUSE-SU-2026:21058-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:2647-1 Security update for nodejs22 SUSE / openSUSE Security Updates · Jun 27, 2026
- openSUSE-SU-2026:11121-1 corepack24-24.17.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- SUSE-SU-2026:2633-1 Security update for nodejs24 SUSE / openSUSE Security Updates · Jun 26, 2026