CVE-2026-11525

lowpriority · track · 0EPSS 0.002 · 15 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (15th) EPSS

CVSS 3.7 · low

Is it mine?

15 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

cvss

Technical severity, 0–10. One row per scoring source.

3.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondaryexploitability 2.2 · impact 1.4

v3.13.7lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

v3.13.4lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-183USCWE-183US

affected products (15)

Products and version ranges known to be affected.

IBM App Connect Enterprise <12.0.12.28all versionscert_bundDE
IBM App Connect Enterprise <13.0.8.1all versionscert_bundDE
IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
IBM App Connect Enterprise< 12.0.12.28cert_bundDE
IBM App Connect Enterprise< 13.0.8.1cert_bundDE
undici undici0 → 6.26.0enisa_euvdEU
undici undici7.0.0 → 7.28.0enisa_euvdEU
undici undici8.0.0 → 8.5.0enisa_euvdEU
nodejs undici< 6.27.0nvdUScpe:2.3:a:nodejs:undici:*:*:*:*:*:*:*:*
nodejs undici7.0.0 → 7.28.0nvdUScpe:2.3:a:nodejs:undici:*:*:*:*:*:*:*:*
nodejs undici8.0.0 → 8.5.0nvdUScpe:2.3:a:nodejs:undici:*:*:*:*:*:*:*:*
npm undici< 6.27.0osvUSpkg:npm/undici
npm undici7.0.0 → 7.28.0osvUSpkg:npm/undici
npm undici8.0.0 → 8.5.0osvUSpkg:npm/undici

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2618IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-08-02csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.
WID-SEC-W-2026-2919IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
GHSA-g8m3-5g58-fq7mundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching2026-06-19ghsa · osvUS
## Impact When undici parses a `Set-Cookie` header, it accepts any `SameSite` attribute value that contains `Strict`, `Lax`, or `None` as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens: - `SameSite=NoneOfYourBusiness` is parsed as `None`, the most permissive setting. - `SameSite=StrictLax` is parsed as `Lax`, a downgrade from `Strict`. Affected applications are those that consume `Set-Cookie` headers from server responses (for example via undici's `fetch` or proxy code paths) and then forward or rely on the parsed `sameSite` attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. ## Patches Upgrade to undici v6.27.0, v7.28.0 or v8.5.0. ## Workarounds After parsing a `Set-Cookie` header, validate that the resulting `sameSite` attribute is one of `'Strict'`, `'Lax'`, or `'None'` (exact, case-insensitive) before forwarding or relying on it.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2026-06-17modified 2026-06-25

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan