GHSA-v3r7-h72x-cjcm

Suggest an improvement
Source
https://github.com/advisories/GHSA-v3r7-h72x-cjcm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v3r7-h72x-cjcm/GHSA-v3r7-h72x-cjcm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-v3r7-h72x-cjcm
Aliases
Downstream
CGA (80)
ECHO (1)
MINI (21)
Published
2026-08-03T19:30:52Z
Modified
2026-09-10T03:51:14Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
Details

Impact

The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.

Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0.

Workarounds

  • Sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie.
  • Do not pass user-controlled data to the unparsed field.
Database specific 
{
    "cwe_ids":  [
        "CWE-74"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-03T19:30:52Z",
    "nvd_published_at":  "2026-07-29T17:16:51Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / undici

Package

Name
undici
View open source insights on deps.dev
Purl
pkg:npm/undici

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.28.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v3r7-h72x-cjcm/GHSA-v3r7-h72x-cjcm.json"

npm / undici

Package

Name
undici
View open source insights on deps.dev
Purl
pkg:npm/undici

Affected ranges

Type
SEMVER
Events
Introduced
7.0.0
Fixed
7.29.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v3r7-h72x-cjcm/GHSA-v3r7-h72x-cjcm.json"

npm / undici

Package

Name
undici
View open source insights on deps.dev
Purl
pkg:npm/undici

Affected ranges

Type
SEMVER
Events
Introduced
8.0.0
Fixed
8.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v3r7-h72x-cjcm/GHSA-v3r7-h72x-cjcm.json"