CVE-2026-16729
Impact
The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.
Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.
Patches
Patched in undici v6.28.0, v7.29.0, and v8.9.0.
Workarounds
- Sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie.
- Do not pass user-controlled data to the unparsed field.
CSIRTS triage
- What
- Cookie attribute injection vulnerability due to unsanitized domain and unparsed setCookie fields.
- Who is affected
- Applications using undici HTTP client library.
- Urgency
- Medium priority with CVSS 4.8; not yet exploited but allows cookie manipulation.
- Action
- Update undici to a patched version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-16729
Get an email if CVE-2026-16729 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Advisory coverage (3)
- mediumCVE-2026-16729: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie …msrc · 2026-08-06
- mediumGHSA-v3r7-h72x-cjcm: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCo…ghsa · 2026-08-03
- mediumCVE-2026-16729: undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0…nvd · 2026-07-29
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-16729)