AIKIDO-2026-48713

TL;DR

undici's Set-Cookie parser percent-decodes cookie values with qsUnescape, turning encoded sequences such as %0D%0A, %00, %3B, and %3D into their literal bytes, even though RFC 6265 specifies no decoding. An application that parses a Set-Cookie header and forwards the parsed value into one of its own response headers can be tricked by a malicious upstream into injecting carriage-return and line-feed bytes and adding arbitrary Set-Cookie, Location, or Cache-Control headers. This enables HTTP response header injection leading to session fixation, open redirect, or cache poisoning. The fix stops percent-decoding cookie values during parsing.