CVE-2026-16729: 
JavaScript vulnerability analysis and mitigation

CVE-2026-16729 is a cookie attribute injection vulnerability in the undici Node.js HTTP client library, specifically in its setCookie function. The flaw allows attacker-influenced input to inject additional cookie attributes by exploiting insufficient sanitization of the domain value and entries in the unparsed array. Affected versions include undici before 6.28.0, 7.0.0 up to before 7.29.0, and 8.0.0 up to before 8.9.0. It was disclosed on July 29, 2026, with a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component — Injection). There are two distinct injection paths: first, validateCookieDomain does not reject semicolons (unlike validateCookiePath, which already blocks 0x3B), so a domain value such as example.com; SameSite=None is passed verbatim, appending unintended cookie attributes. Second, the unparsed array loop only verifies that each entry contains an = sign but does not sanitize values, meaning an entry like X-Custom=val; HttpOnly injects HttpOnly without the caller explicitly setting cookie.httpOnly = true. Exploitation requires that the application passes user-controlled input to the domain or unparsed fields of setCookie, a pattern common in multi-tenant or reverse-proxy architectures (GitHub Advisory).

Successful exploitation can allow an attacker to bypass SameSite CSRF protections, or force, strip, or override the Secure, HttpOnly, and SameSite cookie attributes without the application's knowledge. In multi-tenant or reverse-proxy deployments where session cookies are scoped to a tenant-supplied domain, this could enable cross-site request forgery attacks or weaken cookie security posture, potentially exposing session tokens. Availability is not impacted, but both confidentiality and integrity are partially affected (GitHub Advisory).

1. Identify a vulnerable target: Find a web application using undici (versions < 6.28.0, 7.0.0–7.28.x, or 8.0.0–8.8.x) that passes user-controlled input — such as a tenant-supplied domain — directly to the setCookie function's domain field or unparsed array.
2. Craft a malicious domain value: Supply a domain string containing a semicolon followed by a desired cookie attribute, e.g., attacker.com; SameSite=None, to inject the SameSite=None attribute into the resulting Set-Cookie header without the application explicitly setting it.
3. Craft a malicious unparsed entry: Alternatively, supply an entry to the unparsed array such as X-Custom=val; HttpOnly to inject the HttpOnly attribute, or X-Custom=val; Secure=false to strip the Secure flag.
4. Trigger cookie issuance: Cause the application to issue a session or authentication cookie using the manipulated input, resulting in a Set-Cookie header with injected attributes delivered to the victim's browser.
5. Exploit the weakened cookie: Use the injected attributes to bypass CSRF protections (e.g., SameSite=None enables cross-site requests) or to access cookies that should have been HttpOnly-protected, depending on the injected attribute (GitHub Advisory).

• Network: HTTP responses containing Set-Cookie headers with unexpected or duplicate cookie attributes (e.g., SameSite=None appearing without application intent, or HttpOnly present when not configured by the application).
• Logs: Application or proxy logs showing tenant-supplied domain values containing semicolons or other special characters being passed to cookie-setting logic.
• Application Behavior: Session cookies missing expected Secure or HttpOnly flags, or exhibiting unexpected SameSite values inconsistent with application configuration.

Upgrade undici to the patched versions: 6.28.0, 7.29.0, or 8.9.0, depending on the version branch in use. As a workaround for applications that cannot immediately upgrade, sanitize domain values against the RFC 1034 letter-digit-hyphen character set before passing them to setCookie, and avoid passing any user-controlled data to the unparsed field entirely (GitHub Advisory).

The advisory was published by mcollina (a core Node.js maintainer) on July 29, 2026, with remediation review credited to UlisesGascon. The vulnerability was assigned a "Moderate" severity rating by the undici project. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).