# CVE-2026-16729: Node.js undici cookie attribute injection in setCookie

Source: https://junglewise.ai/threats/cve-2026-16729-node-js-undici-cookie-attribute-injection-in-setcookie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-16729 · Severity: medium · CVSS 4.8 · Published 2026-07-29

Undici, a popular HTTP client for Node.js, contains a vulnerability in how it handles web cookies. If an application allows users to influence cookie settings (common in multi-tenant or proxy services), an attacker could inject malicious cookie attributes. This could allow them to bypass security protections like CSRF defenses or manipulate how session data is stored and secured.

Technologies: [undici (npm)](https://junglewise.ai/threats/technologies/undici). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-16729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16729 being exploited in the wild.

**How severe is CVE-2026-16729?** Medium severity, with a CVSS score of 4.8, published 29 July 2026.

**Which products and versions are affected?** undici (npm) SEMVER:introduced=0,fixed=6.28.0.

**Is there a fix for CVE-2026-16729?** Yes. undici (npm): upgrade to 6.28.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16729 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16729?** Check whether you run undici (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- undici (npm): upgrade to 6.28.0 or later

  ```sh
  npm install undici@6.28.0
  ```


## Technical details

The `setCookie` function in Undici contains two injection paths due to improper neutralization of special elements (CWE-74). First, `validateCookieDomain` fails to reject semicolons, allowing an attacker to append additional attributes (e.g., `SameSite=None`) to the `domain` value. Second, the `unparsed` array loop only checks for the presence of an equals sign without sanitizing values, allowing arbitrary attribute injection. Attackers can exploit this to bypass SameSite CSRF protections or force/strip `Secure` and `HttpOnly` flags. The vulnerability is patched in versions 6.28.0, 7.29.0, and 8.9.0.

## Affected products

- nodejs undici < 6.28.0, >= 7.0.0 < 7.29.0, >= 8.0.0 < 8.9.0

## Identifiers

- CVE-2026-16729
- GHSA-v3r7-h72x-cjcm

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: patched
- 2026-08-03: advisory

## References

- [https://api.github.com/users/Zelys-DFKH](https://api.github.com/users/Zelys-DFKH)
- [https://github.com/Zelys-DFKH](https://github.com/Zelys-DFKH)
- [https://api.github.com/users/Zelys-DFKH/gists%7B/gist_id%7D](https://api.github.com/users/Zelys-DFKH/gists%7B/gist_id%7D)
- [https://api.github.com/users/Zelys-DFKH/repos](https://api.github.com/users/Zelys-DFKH/repos)
- [https://avatars.githubusercontent.com/u/18008809?v=4](https://avatars.githubusercontent.com/u/18008809?v=4)
- [https://api.github.com/users/Zelys-DFKH/events%7B/privacy%7D](https://api.github.com/users/Zelys-DFKH/events%7B/privacy%7D)

## Related threats

- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)
- [undici WebSocket client denial of service via unbounded PONG buffering](https://junglewise.ai/threats/cve-2026-109932-undici-is-an-http-client-library-for-node-js-in-versions-5-15-0)
- [undici EventSource memory exhaustion denial of service](https://junglewise.ai/threats/cve-2026-109924-undici-is-an-http-client-library-for-node-js-in-versions-6-5-0)
- [undici HTTP client denial of service via excessive content-encodings](https://junglewise.ai/threats/cve-2026-109869-undici-is-an-http-client-library-for-node-js-in-versions-6-23-0)