CVE-2026-16729 Nodejs CVE debrief

Who should care

Developers and administrators using undici library in their applications, especially those that pass user-controlled input to cookie attributes, should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing and sanitizing user-controlled input, implementing compensating controls, and monitoring for potential SameSite CSRF protections bypass and attribute manipulation. Security teams and vulnerability management teams should also be aware of this issue and prioritize mitigation efforts based on the potential impact on their applications and systems.

Technical summary

The undici library's setCookie function does not fully sanitize cookie attributes, allowing attacker-influenced input to inject additional attributes. This issue affects undici versions before 6.28.0, 7.29.0, and 8.9.0, and can lead to SameSite CSRF protections bypass and attribute manipulation. Technical impact includes potential for attackers to append attributes such as SameSite, HttpOnly, and Secure. Affected applications pass user-controlled input to cookie attributes, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain.

Defensive priority

Medium-priority defensive actions are recommended due to the potential for SameSite CSRF protections bypass and attribute manipulation.

Recommended defensive actions

• Apply undici updates to versions 6.28.0, 7.29.0, or 8.9.0, or later
• Review and sanitize user-controlled input to cookie attributes
• Implement compensating controls, such as validating cookie attributes
• Monitor for potential SameSite CSRF protections bypass and attribute manipulation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The undici library's setCookie function does not fully sanitize cookie attributes, allowing attacker-influenced input to inject additional attributes. This issue affects undici versions before 6.28.0, 7.29.0, and 8.9.0. Evidence is limited to public CVE and NVD details. Defenders should verify undici usage, review cookie attribute handling, and monitor for potential SameSite CSRF protections bypass and attribute manipulation. Additional verification is needed to confirm affected scope and severity.

Official resources