{"id":"GHSA-v3r7-h72x-cjcm","summary":"undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields","details":"## Impact\n\nThe `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `example.com; SameSite=None` lands verbatim as `Domain=example.com; SameSite=None`. The `unparsed` array's loop only checks each entry contains `=` and does not sanitize values, so an entry like `X-Custom=val; HttpOnly` lands unchanged, injecting `HttpOnly` without the caller setting `cookie.httpOnly = true`.\n\nApplications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, `Secure` or `HttpOnly` forced or stripped, or the intended SameSite tier overridden.\n\n## Patches\n\nPatched in undici v6.28.0, v7.29.0, and v8.9.0.\n\n## Workarounds\n\n- Sanitize `domain` values against the RFC 1034 letter-digit-hyphen set before passing to `setCookie`.\n- Do not pass user-controlled data to the `unparsed` field.","aliases":["CVE-2026-16729"],"modified":"2026-08-03T19:45:08.619498694Z","published":"2026-08-03T19:30:52Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-08-03T19:30:52Z","nvd_published_at":"2026-07-29T17:16:51Z","cwe_ids":["CWE-74"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.28.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"}],"affected":[{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.28.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v3r7-h72x-cjcm/GHSA-v3r7-h72x-cjcm.json"}},{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.29.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v3r7-h72x-cjcm/GHSA-v3r7-h72x-cjcm.json"}},{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.9.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-v3r7-h72x-cjcm/GHSA-v3r7-h72x-cjcm.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}