CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

• CWE-74

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm

Published

Jul 29, 2026

Last Modified

Jul 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1669Arbitrary file read in the model loading mechanism (HDF5 int…7.5
• CVE-2026-1670The affected products are vulnerable to an unauthenticated A…9.8
• CVE-2026-1671The Activity Log for WordPress plugin for WordPress is vulne…6.5
• CVE-2026-1672The BEAR – Bulk Editor and Products Manager Professional for…6.5
• CVE-2026-16723A remote code execution (RCE) vulnerability exists in fastjs…9
• CVE-2026-16728undici's retry interceptor can deliver a response whose body…4.8
• CVE-2026-1673The BEAR – Bulk Editor and Products Manager Professional for…4.3
• CVE-2026-16730A flaw was found in dbus-broker. When the process file-descr…5.5
• CVE-2026-16733A weakness has been identified in bahmutov find-cypress-spec…5.3
• CVE-2026-16735A security vulnerability has been detected in release-it con…5.3
• CVE-2026-1674The Gutena Forms – Contact Form, Survey Form, Feedback Form,…6.5
• CVE-2026-16743A flaw was found in accountsservice. The systemd-homed code …5.5