CVE-2026-16729
CVE-2026-16729 is a medium-severity vulnerability in Nodejs Undici with a CVSS 3.x base score of 4.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.
Key facts
- Severity: Medium (CVSS 3.x base score 4.8)
- EPSS exploit prediction: 0% (6th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-74
- Affected product: Nodejs Undici
- Published:
- Last modified:
Description
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
Frequently asked questions
- What is CVE-2026-16729?
- undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
- How severe is CVE-2026-16729?
- CVE-2026-16729 has a CVSS 3.x base score of 4.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2026-16729 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-16729?
- CVE-2026-16729 affects Nodejs Undici. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-16729?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-16729 published?
- CVE-2026-16729 was published on 2026-07-29 and last updated on 2026-08-05.
References
- https://cna.openjsf.org/security-advisories.html
- https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm
Affected products (1)
- cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*
More vulnerabilities in Nodejs Undici
- CVE-2026-6734 — High (CVSS 7.5): Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying…
- CVE-2026-9675 — High (CVSS 7.5): Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of…
- CVE-2026-12151 — High (CVSS 7.5): Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but…
- CVE-2026-2229 — High (CVSS 7.5): ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of…
- CVE-2026-1528 — High (CVSS 7.5): ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's…
- CVE-2026-1526 — High (CVSS 7.5): The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during…
All CVEs affecting Nodejs Undici →
Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities
- CVE-2026-54159 — Critical (CVSS 10.0): PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the…
- CVE-2026-44182 — Critical (CVSS 10.0): Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark,…
- CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
- CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
- CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
- CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →