Answer in brief
CVE-2026-16729 records a Medium severity csrf vulnerability in undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Answer in brief
CVE-2026-16729 records a Medium severity csrf vulnerability in undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Update undici to 6.28.0; undici to 7.29.0; undici to 8.9.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanCSRF describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-16729 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| undicinpm | <6.28.0 | 6.28.0 |
| undicinpm | >=7.0.0,<7.29.0 | 7.29.0 |
| undicinpm | >=8.0.0,<8.9.0 | 8.9.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-16729 records a Medium severity csrf vulnerability in undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for undici, undici, undici.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate undici to 6.28.0; undici to 7.29.0; undici to 8.9.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanCSRF describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-16729 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| undicinpm | <6.28.0 | 6.28.0 |
| undicinpm | >=7.0.0,<7.29.0 | 7.29.0 |
| undicinpm | >=8.0.0,<8.9.0 | 8.9.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-16729 records a Medium severity csrf vulnerability in undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for undici, undici, undici.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard## Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `example.com; SameSite=None` lands verbatim as `Domain=example.com; SameSite=None`. The `unparsed` array's loop only checks each entry contains `=` and does not sanitize values, so an entry like `X-Custom=val; HttpOnly` lands unchanged, injecting `HttpOnly` without the caller setting `cookie.httpOnly = true`. Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, `Secure` or `HttpOnly` forced or stripped, or the intended SameSite tier overridden. ## Patches Patched in undici v6.28.0, v7.29.0, and v8.9.0. ## Workarounds - Sanitize `domain` values against the RFC 1034 letter-digit-hyphen set before passing to `setCookie`. - Do not pass user-controlled data to the `unparsed` field.
## Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons (`validateCookiePath` already does at 0x3B), so a `domain` value like `example.com; SameSite=None` lands verbatim as `Domain=example.com; SameSite=None`. The `unparsed` array's loop only checks each entry contains `=` and does not sanitize values, so an entry like `X-Custom=val; HttpOnly` lands unchanged, injecting `HttpOnly` without the caller setting `cookie.httpOnly = true`. Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, `Secure` or `HttpOnly` forced or stripped, or the intended SameSite tier overridden. ## Patches Patched in undici v6.28.0, v7.29.0, and v8.9.0. ## Workarounds - Sanitize `domain` values against the RFC 1034 letter-digit-hyphen set before passing to `setCookie`. - Do not pass user-controlled data to the `unparsed` field.