← Vulnerability feed

Vulnerability record · CVE-2026-16729 · published 29 July 2026

CVE-2026-16729: Nodejs undici injection vulnerability

Nodejs · Undici

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

6.5 CVSS 3.1 Medium EPSS 0.19% · top 92.2% CWE-74 · Injection
6.5CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
5 Aug 2026Last modified by NVD

Description

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.openjsf.org/security-advisories.html Vendor Advisory
https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm Vendor Advisory

Track CVE-2026-16729 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-1525Nodejs undici http request smuggling vulnerabilityUndici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-leng…EPSS 0.49%9.8CVE-2022-35949Nodejs undici server-side request forgery (ssrf) vulnerabilityundici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes…EPSS 1.8%9.1CVE-2026-84961Nodejs undici improper certificate validation vulnerabilityundici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Bec…EPSS 0.25%9.1CVE-2026-13697Nodejs undici information exposure vulnerabilityundici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a…EPSS 0.57%8.8CVE-2026-6734Nodejs undici origin validation error vulnerabilityImpact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches…EPSS 0.39%8.2CVE-2026-84933Nodejs undici information exposure vulnerabilityundici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that …EPSS 0.34%7.5CVE-2026-19534Nodejs undici unchecked return value vulnerabilityundici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client ne…EPSS 0.39%7.5CVE-2026-85014Nodejs undici vulnerabilityundici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close…EPSS 0.54%

Source: NIST National Vulnerability Database (record CVE-2026-16729), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.