undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

🗓️ 10 Jul 2026 17:41:23Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

undici cookie parser mis-decodes Set-Cookie, enabling header injection for session fixation and redirects.

Reporter	Title	Published	Views	Family All 59
Amazon	Important: nodejs22	7 Jul 202600:00	–	amazon
CBLMariner	CVE-2026-9679 affecting package nodejs for versions less than 24.17.0-2	11 Jul 202620:00	–	cbl_mariner
Chainguard	CVE-2026-9679 vulnerabilities	23 Jun 202608:16	–	cgr
Circl	CVE-2026-9679	17 Jun 202616:59	–	circl
CVE	CVE-2026-9679	17 Jun 202616:56	–	cve
Cvelist	CVE-2026-9679 undici vulnerable to HTTP header injection via Set-Cookie percent-decoding	17 Jun 202616:56	–	cvelist
Debian CVE	CVE-2026-9679	17 Jun 202616:56	–	debiancve
EUVD	EUVD-2026-37764	19 Jun 202614:21	–	euvd
Github Security Blog	undici vulnerable to HTTP header injection via Set-Cookie percent-decoding	19 Jun 202614:21	–	github
NVD	CVE-2026-9679	17 Jun 202618:18	–	nvd

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	nodejs26	26.5.0-1.3.hum1	nodejs26-26.5.0-1.3.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	nodejs26	26.5.0-1.3.hum1	nodejs26-26.5.0-1.3.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	nodejs26-bin	26.5.0-1.3.hum1	nodejs26-bin-26.5.0-1.3.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-9679
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-9679
cve	www.cve.org/CVERecord

16 Jul 2026 02:22Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.15.9

EPSS0.00257

SSVC

undici cookie parsing set cookie header header injection upstream control session fixation open redirect cache poisoning