Detections
Analytics

SCA: security update for undici (GHSA-p88m-4jfj-68fv)

medium Tenable Self-Hosted Container Security Plugin ID 443604

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning
 encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does
 not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header
 and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become
 vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-
 Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session
 fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie
 parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response
 header. This was introduced in undici 7.0.0 via PR #3789. Patches: Upgrade to undici v6.26.0, v7.28.0 or
 v8.5.0. Workarounds: If upgrade is not immediately possible, do not forward values returned by
 parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip
 or reject CR, LF, NUL, ;, and = bytes. (CVE-2026-9679)

Solution

Update the undici library and its related packages to version 6.27.0 or later.

See Also

https://github.com/advisories/GHSA-p88m-4jfj-68fv

Plugin Details

Severity: Medium

ID: 443604

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 6/19/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.71

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-9679

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/19/2026

Vulnerability Publication Date: 6/17/2026

Reference Information

CVE: CVE-2026-9679

cwe: CWE-93