DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-16729: CVE-2026-16729: Cookie Attribute Injection in Undici via Unsanitized Domain and Unparsed Fields

#security #cve #cybersecurity

CVE-2026-16729: Cookie Attribute Injection in Undici via Unsanitized Domain and Unparsed Fields

Vulnerability ID: CVE-2026-16729
CVSS Score: 4.8
Published: 2026-08-03

CVE-2026-16729 (GHSA-v3r7-h72x-cjcm) is a medium-severity cookie attribute injection vulnerability in Undici's web-compliant cookie utility module. Due to insufficient validation of domain parameters and raw attributes in the unparsed options array, arbitrary attributes like SameSite, HttpOnly, and Secure can be injected. This allows attackers to bypass CSRF protections, strip security flags, or override intended cookie behaviors when applications pass user-controlled values to these properties.

TL;DR

A vulnerability in Undici allows remote attackers to inject arbitrary cookie attributes (such as SameSite, HttpOnly, and Secure) via unsanitized domain inputs and custom unparsed options arrays, undermining core web-security mitigations like CSRF protections.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-74
  • Attack Vector: Network
  • CVSS v3.1 Score: 4.8
  • Exploit Status: poc
  • CISA KEV Status: No
  • Ransomware Association: No

Affected Systems

  • Undici HTTP Client (Node.js)
  • undici: < 6.28.0 (Fixed in: 6.28.0)
  • undici: >= 7.0.0 < 7.29.0 (Fixed in: 7.29.0)
  • undici: >= 8.0.0 < 8.9.0 (Fixed in: 8.9.0)

Code Analysis

Commit: 10d93fc

Fixes cookie attribute injection within the v6 branch of Undici.

Commit: 3bf91dd

Fixes cookie attribute injection within the v7 branch of Undici.

Commit: af74840

Fixes cookie attribute injection within the v8 branch of Undici.

Mitigation Strategies

  • Upgrade Undici to patched versions (6.28.0, 7.29.0, or 8.9.0).
  • Sanitize and validate user-supplied domains at the application layer using strict RFC 1123 compliance checks.
  • Block semicolon (;) characters in any user inputs mapped directly to HTTP headers or cookie options.
  • Implement deep validation on keys and values populated into the custom unparsed cookie configuration array.

Remediation Steps:

  1. Identify the active version of Undici inside your project environment using commands like npm ls undici or yarn why undici.
  2. Upgrade Undici to the latest secure version: run npm install undici@latest or configure an explicit dependency override in package.json.
  3. Implement application-level sanitization filters on all domain inputs used in cookie configurations.
  4. Deploy code fixes and perform automated integration testing to ensure cookie header structures remain intact.

References

Read the full report for CVE-2026-16729 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)