What is the CVSS score of EUVD-2026-37758?

EUVD-2026-37758 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-37758?

Yes, a patch is available for EUVD-2026-37758. Update the affected software to the latest version immediately.

undici EUVD-2026-37758

| CVE-2026-11525 LOW

Permissive List of Allowed Inputs (CWE-183)

2026-06-17 openjs

GHSA-g8m3-5g58-fq7m

Information Disclosure Undici

3.7

CVSS 3.1 · Vendor: openjs

Severity by source

Vendor (openjs) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

AV:N because exploitation requires a network-accessible upstream server under attacker control; AC:H for that server-control prerequisite; PR:N as no client-side privileges are needed; I:L for integrity impact limited to SameSite policy downgrade; C and A remain N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 19, 2026 - 16:01 EUVD

Analysis Generated

Jun 17, 2026 - 18:14 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).

Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.

This was introduced in undici 5.15.0 when the cookies feature was added.

Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.

Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

AnalysisAI

SameSite attribute parsing in undici's cookie implementation uses substring matching instead of the case-insensitive exact match required by RFC 6265, enabling a malicious or non-compliant upstream server to silently downgrade a cookie's SameSite enforcement to a more permissive value. All undici installations from v5.15.0 onward through the unpatched release branches are affected when consuming Set-Cookie headers via undici's fetch or proxy code paths and forwarding or relying on the parsed sameSite attribute. No public exploit has been identified and no CISA KEV listing exists at time of analysis; however, the integrity impact is concrete in architectures where SameSite policy enforcement is delegated to the parsed cookie attribute.

Technical ContextAI

undici is a high-performance, ground-up HTTP/1.1 client for Node.js, maintained by the OpenJS Foundation and widely used as the underlying fetch and proxy implementation in Node.js applications. The vulnerability resides in the cookie parsing component introduced in v5.15.0. CWE-183 (Permissive List of Allowed Inputs) identifies the root cause: the parser accepts any SameSite token value that contains 'Strict', 'Lax', or 'None' as a substring, rather than validating against the exact case-insensitive token set mandated by RFC 6265 Section 4.1.1. This causes values such as 'SameSite=NoneOfYourBusiness' to be silently normalized to SameSite=None (the most permissive setting), and 'SameSite=StrictLax' to be normalized to SameSite=Lax (a downgrade from Strict). The affected CPE cpe:2.3:a:undici:undici:*:*:*:*:*:*:*:* spans all platforms and architectures. Applications acting as reverse proxies, API gateways, or server-side fetch clients that consume and forward or trust the parsed sameSite attribute are the primary at-risk surface; applications that never inspect or relay this attribute are not affected.

RemediationAI

The primary fix is to upgrade undici to v6.26.0, v7.28.0, or v8.5.0, which implement spec-compliant case-insensitive exact matching for SameSite attribute values per RFC 6265. Full details are in the vendor advisory at https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m. If an immediate upgrade is not feasible, the vendor-recommended workaround is to add application-level validation after parsing any Set-Cookie header: check that the resulting sameSite attribute is exactly one of 'Strict', 'Lax', or 'None' (case-insensitive comparison), and reject or treat as maximally restrictive any value outside this set before forwarding or relying on it. This workaround requires code changes at the application layer and does not remediate the underlying library defect, meaning future undici updates may re-expose the issue if the workaround is removed. Applications that do not consume, forward, or make trust decisions based on the parsed sameSite attribute require no immediate action but should still upgrade to eliminate the defect.