CVE-2026-16729
published 2026-07-29CVE-2026-16729: undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before…
PriorityP334medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.19%
8.8th percentile
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nodejs | undici | < 6.28.0 | 6.28.0 |
| nodejs | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| nodejs | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
| undici | undici | < 6.28.0 | 6.28.0 |
| undici | undici | >= 0 < 6.28.0 | 6.28.0 |
| undici | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| undici | undici | >= 7.0.0 < 7.29.0 | 7.29.0 |
| undici | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
| undici | undici | >= 8.0.0 < 8.9.0 | 8.9.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
ghsa·2026-08-03
CVE-2026-16729 [MEDIUM] CWE-74 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
## Impact
The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `example.com; SameSite=None` lands verbatim as `Domain=example.com; SameSite=None`. The `unparsed` array's loop only checks each entry contains `=` and does not sanitize values, so an entry like `X-Custom=val; HttpOnly` lands unchanged, injecting `HttpOnly` without the caller setting `cookie.httpOnly = true`.
Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protec
Red Hat
undici: Undici: Cookie attribute injection allows bypassing security protections
vendor_redhat·2026-07-29·CVSS 6.5
CVE-2026-16729 [MEDIUM] CWE-140 undici: Undici: Cookie attribute injection allows bypassing security protections
undici: Undici: Cookie attribute injection allows bypassing security protections
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections by
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-29
Published