undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

LLM-synthesized narrative grounded in this CVE's description and references.

Versions sourced from the GitHub Security Advisory.

• Undici/Undicillm-fuzzy
• osv-coords34 versions

  pkg:apk/chainguard/actions-runnerpkg:apk/chainguard/code-serverpkg:apk/chainguard/gemini-clipkg:apk/chainguard/harakapkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/node-gyppkg:apk/chainguard/npmpkg:apk/chainguard/pelias-apipkg:apk/chainguard/prismpkg:apk/chainguard/py3.10-captumpkg:apk/chainguard/py3.11-captumpkg:apk/chainguard/py3.12-captumpkg:apk/chainguard/py3.13-captumpkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/vitess-24pkg:apk/wolfi/code-serverpkg:apk/wolfi/node-gyppkg:apk/wolfi/npmpkg:apk/wolfi/prismpkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/vitess-24pkg:rpm/opensuse/nodejs24&distro=openSUSE%20Tumbleweed

  < 2.335.1-r1+ 33 more

  • (no CPE)range: < 2.335.1-r1
  • (no CPE)range: < 4.125.0-r2
  • (no CPE)range: < 0.49.0-r4
  • (no CPE)range: < 3.3.1-r1
  • (no CPE)range: < 8.19.16-r6
  • (no CPE)range: < 8.19.16-r6
  • (no CPE)range: < 8.19.16-r6
  • (no CPE)range: < 9.1.10-r21
  • (no CPE)range: < 9.1.10-r21
  • (no CPE)range: < 9.2.8-r9
  • (no CPE)range: < 9.2.8-r9
  • (no CPE)range: < 9.3.5-r4
  • (no CPE)range: < 9.3.5-r4
  • (no CPE)range: < 9.4.2-r5
  • (no CPE)range: < 9.4.2-r5
  • (no CPE)range: < 13.0.0-r1
  • (no CPE)range: < 11.17.0-r1
  • (no CPE)range: < 7.8.0-r4
  • (no CPE)range: < 5.15.11-r3
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 0.9.0-r1
  • (no CPE)range: < 43.249.5-r2
  • (no CPE)range: < 1.6.0-r2
  • (no CPE)range: < 24.0.2-r1
  • (no CPE)range: < 4.125.0-r2
  • (no CPE)range: < 13.0.0-r1
  • (no CPE)range: < 11.17.0-r1
  • (no CPE)range: < 5.15.11-r3
  • (no CPE)range: < 43.249.5-r2
  • (no CPE)range: < 1.6.0-r2
  • (no CPE)range: < 24.0.2-r1
  • (no CPE)range: < 24.17.0-1.1

• github.com/advisories/GHSA-p88m-4jfj-68fvghsaADVISORY
• nvd.nist.gov/vuln/detail/CVE-2026-9679ghsaADVISORY
• cna.openjsf.org/security-advisories.htmlghsaWEB
• github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fvghsaWEB

No linked articles in our index yet.