CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

• CWE-74

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcmVendor Advisory

Published

Jul 29, 2026

Last Modified

Aug 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1672The BEAR – Bulk Editor and Products Manager Professional for…6.5
• CVE-2026-16722IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…8.8
• CVE-2026-16723A remote code execution (RCE) vulnerability exists in fastjs…9
• CVE-2026-16724IBM Virtualization Management Interface FW1110.00 through FW…4.5
• CVE-2026-16727Concurrent Execution using Shared Resource with Improper Syn…7.3
• CVE-2026-16728undici's retry interceptor can deliver a response whose body…6.5
• CVE-2026-1673The BEAR – Bulk Editor and Products Manager Professional for…4.3
• CVE-2026-16730A flaw was found in dbus-broker. When the process file-descr…5.5
• CVE-2026-16731OMICRON StationScout before version 3.05 contains a cryptogr…8.3
• CVE-2026-16732fastify is a fast and low overhead web framework for Node.js…6.1
• CVE-2026-16733A weakness has been identified in bahmutov find-cypress-spec…5.3
• CVE-2026-16734The Stripe Payment Forms by WP Full Pay WordPress plugin be…7.5