GHSA-g8m3-5g58-fq7m undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

• npm undici: < 6.27.0 → fixed in 6.27.0 • npm undici: >= 7.0.0, < 7.28.0 → fixed in 7.28.0 • npm undici: >= 8.0.0, < 8.5.0 → fixed in 8.5.0

Impact When undici parses a `Set-Cookie` header, it accepts any `SameSite` attribute value that contains `Strict`, `Lax`, or `None` as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens: • `SameSite=NoneOfYourBusiness` is parsed as `None`, the most permissive setting. • `SameSite=StrictLax` is parsed as `Lax`, a downgrade from `Strict`. Affected applications are those that consume `Set-Cookie` headers from server responses (for example via undici's `fetch` or proxy code paths) and then forward or rely on the parsed `sameSite` attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches Upgrade to undici v6.27.0, v7.28.0 or v8.5.0. Workarounds After parsing a `Set-Cookie` header, validate that the resulting `sameSite` attribute is one of `'Strict'`, `'Lax'`, or `'None'` (exact, case-insensitive) before forwarding or relying on it.