Is CVE-2026-16729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16729 being exploited in the wild.

How severe is CVE-2026-16729?

Medium severity, with a CVSS score of 4.8, published 29 July 2026.

Which products and versions are affected?

undici (npm) SEMVER:introduced=0,fixed=6.28.0.

Is there a fix for CVE-2026-16729?

Yes. undici (npm): upgrade to 6.28.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16729 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16729?

Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16729: Node.js undici cookie attribute injection in setCookie

CVE-2026-16729 · Severity: medium · CVSS 4.8 · Published 2026-07-29

Undici, a popular HTTP client for Node.js, contains a vulnerability in how it handles web cookies. If an application allows users to influence cookie settings (common in multi-tenant or proxy services), an attacker could inject malicious cookie attributes. This could allow them to bypass security protections like CSRF defenses or manipulate how session data is stored and secured.

Technologies: undici (npm). Vendors: npm.

Quick answers

Is CVE-2026-16729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16729 being exploited in the wild.
How severe is CVE-2026-16729?: Medium severity, with a CVSS score of 4.8, published 29 July 2026.
Which products and versions are affected?: undici (npm) SEMVER:introduced=0,fixed=6.28.0.
Is there a fix for CVE-2026-16729?: Yes. undici (npm): upgrade to 6.28.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16729 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16729?: Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 6.28.0 or later
```
npm install undici@6.28.0
```

Technical details

The `setCookie` function in Undici contains two injection paths due to improper neutralization of special elements (CWE-74). First, `validateCookieDomain` fails to reject semicolons, allowing an attacker to append additional attributes (e.g., `SameSite=None`) to the `domain` value. Second, the `unparsed` array loop only checks for the presence of an equals sign without sanitizing values, allowing arbitrary attribute injection. Attackers can exploit this to bypass SameSite CSRF protections or force/strip `Secure` and `HttpOnly` flags. The vulnerability is patched in versions 6.28.0, 7.29.0, and 8.9.0.

Affected products

nodejs undici < 6.28.0, >= 7.0.0 < 7.29.0, >= 8.0.0 < 8.9.0

Identifiers

CVE-2026-16729
GHSA-v3r7-h72x-cjcm

Timeline

2026-07-29: disclosed
2026-07-29: patched
2026-08-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.