CVE-2026-43972: gun Package Cross-Origin Cookie Injection via HTTP/2 PUSH_PROMISE
Summary
CVE-2026-43972: Origin Validation Error vulnerability in ninenines gun (gun_http2 module) allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority. Affects gun across 2 version ranges.
>= 2.0.0, < 2.4.0
>= 871989eef53663285c165fdfb83a5918ebe00d41, < 567863ff53802fed21c3b3f25812db7f7ae29676
Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gun package, developed by ninenines, is a real-time, open-source JavaScript framework designed for building decentralized applications. It supports various transport protocols, including HTTP/2, which enhances performance through features like server push. However, a vulnerability in the gun_http2 module allows for cross-origin cookie injection, posing significant security risks.
Vulnerability Detail
The vulnerability arises from an Origin Validation Error in the gun_http2 module, where the :authority pseudo-header from an incoming HTTP/2 PUSH_PROMISE frame is stored without validation against the connection's origin. This flaw allows a malicious HTTP/2 server to inject cookies into the client's shared cookie store, potentially leading to session fixation attacks and account takeover. The issue violates RFC 7540 and RFC 9113, which mandate that servers should not push resources they are not authoritative for.
How To Fix
Latest published version: 2.7.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling HTTP/2 server push if it is not essential for your application. This can help mitigate the risk of cookie injection until you can update to the patched version.
Conclusion
CVE-2026-43972 presents a significant security risk for applications using the gun package with HTTP/2 server push enabled. It is crucial to update to the patched version to mitigate the risk of cross-origin cookie injection and potential account takeover.
See every vulnerability recorded for gun →
FAQ
CVE-2026-43972 is a vulnerability in the gun package that allows cross-origin cookie injection via unvalidated HTTP/2 PUSH_PROMISE authority.
If your application uses the gun package with HTTP/2 server push enabled, it may be susceptible to cookie injection attacks, potentially leading to session fixation and account takeover.
The vulnerability affects gun versions from 2.0.0 up to, but not including, 2.4.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software, using just the mix.lock file. It helps developers stay informed about potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for gun.
