CVE-2026-16729Medium· 4.8▾ Sunlitundici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.3%
The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.
Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.
Patched in undici v6.28.0, v7.29.0, and v8.9.0.
domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie.unparsed field.undici < 6.28.0undici >= 7.0.0, < 7.29.0undici >= 8.0.0, < 8.9.0Upgrade to a patched release:
undici 6.28.0undici 7.29.0undici 8.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-14643Medium· 5.9undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
CVE-2026-15157Medium· 4.2undici vulnerable to CRLF Injection via blob-like body 'type' property
CVE-2026-16728Medium· 4.8undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-87018High· 7.5undici is an HTTP client library for Node.js
CVE-2026-87029Medium· 5.9undici is an HTTP client library for Node.js
CVE-2026-109932Medium· 5.9undici is an HTTP client library for Node.js