CVE-2026-43972

Name of the Vulnerable Software and Affected Versions ninenines gun versions 2.0.0 through 2.3.x

Description An origin validation error in the gun http2 module allows cross-origin cookie injection through an unvalidated HTTP/2 PUSH PROMISE authority. In the push promise frame() function, the :authority pseudo-header from an incoming PUSH PROMISE frame is stored in the promised stream record without verifying that it matches the connection origin. Subsequently, the headers frame() function calls set cookie header() using this unvalidated authority. This behavior violates protocol standards that require receivers to treat pushes for resources the server is not authoritative for as protocol errors. A malicious or compromised HTTP/2 server can use this to plant cookies for arbitrary third-party domains in the client's shared cookie store, potentially leading to session fixation or account takeover. This is exploitable when the software is configured with a cookie store and connects to an HTTP/2 server with server push enabled.

Recommendations Update to version 2.4.0 or later. As a temporary mitigation, avoid connecting to HTTP/2 servers with server push enabled or disable the cookie store configuration.