undici's setCookie function does not fully sanitize cookie attributes, permitting domain values containing semicolons or unparsed array entries to inject additional attributes such as SameSite, HttpOnly, or Secure. This weakness (CWE‑74, CWE‑140) can allow attackers to bypass SameSite CSRF protections, force or strip Secure and HttpOnly flags, and otherwise manipulate cookie behavior. Applications that pass user‑controlled data to the domain or unparsed fields—common in multi‑tenant or reverse‑proxy configurations—are at risk.

Undici, the HTTP client library for Node.js, is affected in all released versions prior to 6.28.0, before 7.29.0 in the 7.x series, and before 8.9.0 in the 8.x series. Any Node.js application that uses an affected undici version and passes untrusted input into setCookie's domain or unparsed parameters may exploit this vulnerability.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an application that allows attackers to influence the domain or unparsed fields of setCookie—such as by submitting tenant‑specific data to a reverse‑proxy. Because the vulnerability requires user‑controlled input to reach setCookie, the attack surface is limited to systems that expose these fields without validation.