undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | undici | before 6.28.0; 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 | 6.28.0, 7.29.0, 8.9.0 | Patch available | CNA |
| — | undici (npm) | before 6.28.0 | 6.28.0 | Patch available | GHSA-v3r7-h72x-cjcm |
| — | undici (npm) | 7.0.0 to before 7.29.0 | 7.29.0 | Patch available | GHSA-v3r7-h72x-cjcm |
| — | undici (npm) | 8.0.0 to before 8.9.0 | 8.9.0 | Patch available | GHSA-v3r7-h72x-cjcm |
- undici VendorNodeJS Affected before 6.28.0; 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 Fixed in 6.28.0, 7.29.0, 8.9.0 Patch available CNA
- undici (npm) Vendor— Affected before 6.28.0 Fixed in 6.28.0 Patch available GHSA-v3r7-h72x-cjcm
- undici (npm) Vendor— Affected 7.0.0 to before 7.29.0 Fixed in 7.29.0 Patch available GHSA-v3r7-h72x-cjcm
- undici (npm) Vendor— Affected 8.0.0 to before 8.9.0 Fixed in 8.9.0 Patch available GHSA-v3r7-h72x-cjcm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* | before 6.28.0; 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 | Vulnerable | NodeJS |
- cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* Versions before 6.28.0; 7.0.0 to before 7.29.0; 8.0.0 to before 8.9.0 Vulnerable ·NodeJS
Remediation
- Fix · CNA undici (undici) Fixed in 6.28.0, 7.29.0, 8.9.0
- Fix · GHSA-v3r7-h72x-cjcm undici (npm) Fixed in 6.28.0 Advisory →
- Fix · GHSA-v3r7-h72x-cjcm undici (npm) Fixed in 7.29.0 Advisory →
- Fix · GHSA-v3r7-h72x-cjcm undici (npm) Fixed in 8.9.0 Advisory →
Red Hat 2 advisories
- RHSA-2026:48537 Released 2026-07-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs24-1:24.18.1-0.1.hum1@aarch64, nodejs24-1:24.18.1-0.1.hum1@src, nodejs24-1:24.18.1-0.1.hum1@x86_64 +14
- RHSA-2026:48273 Released 2026-07-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs26-1:26.5.1-1.5.hum1@aarch64, nodejs26-1:26.5.1-1.5.hum1@src, nodejs26-1:26.5.1-1.5.hum1@x86_64 +14
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
undici 6.28.0, 7.29.0, 8.9.0
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-13930 undici vulnerable to downstream response desynchronization via retry interceptorPriority LOW 29
- TI-2026-12768 undici vulnerable to CRLF Injection via blob-like body 'type' propertyPriority LOW 24
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat Hardened Images | Fixed | RHSA-2026:48273, RHSA-2026:48537 |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16729
- 2026-10-03 Alias added: GHSA-v3r7-h72x-cjcm
References
Advisory 3
Other 7
- https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5
- https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef
- https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235
- https://github.com/nodejs/undici
- https://github.com/nodejs/undici/releases/tag/v6.28.0
- https://github.com/nodejs/undici/releases/tag/v7.29.0
- https://github.com/nodejs/undici/releases/tag/v8.9.0
More NodeJS Undici vulnerabilities
- TI-2026-01215 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CVSS 3.1CRITICAL 9.8
- TI-2022-16376 `undici.request` vulnerable to SSRF using absolute URL on `pathname` CVSS 3.1CRITICAL 9.8
- TI-2023-09734 CRLF Injection in Nodejs ‘undici’ via host CVSS 3.1MEDIUM 6.5
- TI-2022-13193 CRLF injection in request headers CVSS 3.1MEDIUM 6.5
- TI-2022-16375 CRLF Injection in Nodejs ‘undici’ via Content-Type CVSS 3.1MEDIUM 5.3
- TI-2022-13194 Uncleared cookies on cross-host/cross-origin redirect in undici CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-16729 · CVE Program
- CVE-2026-16729 · NVD
- FIRST EPSS
- GHSA-v3r7-h72x-cjcm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-16729 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences