CVE-2026-16729

Analyzed Analyzed - Analysis Complete

Cookie Attribute Injection in Undici

Publication date: 2026-07-29

Last updated on: 2026-08-05

Assigner: openjs

Description

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-05

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16729

EUVD

EUVD-2026-50416

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	undici	From 7.0.0 (inc) to 7.29.0 (exc)
nodejs	undici	From 8.0.0 (inc) to 8.9.0 (exc)
nodejs	undici	to 6.28.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves undici's setCookie function not properly sanitizing cookie attributes. Attackers can inject additional cookie attributes like SameSite, HttpOnly, or Secure by manipulating the domain or unparsed input fields. This affects applications that use user-controlled input for cookie attributes.

Detection Guidance

To detect this vulnerability, check the version of undici in your system using commands like 'npm list undici' for Node.js projects or inspect package.json. Versions before 6.28.0, 7.29.0, or 8.9.0 are vulnerable.

Impact Analysis

If you use undici versions before 6.28.0, 7.29.0, or 8.9.0, attackers could bypass SameSite CSRF protections or manipulate cookie attributes like Secure, HttpOnly, or SameSite. This could lead to session hijacking, unauthorized access, or data theft in applications passing user-controlled input to cookies.

Compliance Impact

This vulnerability could compromise session security, potentially violating GDPR's data protection requirements or HIPAA's safeguards for sensitive data. Unauthorized access due to cookie manipulation may lead to data breaches, resulting in non-compliance with these regulations.

Mitigation Strategies

Immediately update undici to version 6.28.0, 7.29.0, or 8.9.0 or later. If updating is not possible, review and sanitize all inputs passed to setCookie, especially domain values, to prevent attribute injection.

Hi! I’m here to help you understand CVE-2026-16729. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70