CVE-2026-16729

About vulnerability

Impact

The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons (validateCookiePath already does at 0x3B), so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array’s loop only checks each entry contains = and does not sanitize values, so an entry like X-Custom=val; HttpOnly lands unchanged, injecting HttpOnly without the caller setting cookie.httpOnly = true.

Applications that pass user-controlled input to these fields, typically multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, Secure or HttpOnly forced or stripped, or the intended SameSite tier overridden.

Patches

Patched in undici v6.28.0, v7.29.0, and v8.9.0.

Workarounds

• Sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing to setCookie.
• Do not pass user-controlled data to the unparsed field.

Affected product:

@graphql-cli/common , AngularJS , Lodash , MariaDB , MetaMask/core , Next.js , Node.js , Protocol Buffers , React , Vue , a2a-js-sdk , adk-js , ai , ai-sdk-amazon-bedrock , ai-sdk-anthropic , ai-sdk-google , ai-sdk-groq , ai-sdk-mistral , ai-sdk-openai-compatible , ai-sdk-perplexity , ai-sdk-react , ai-sdk-xai , api-extractor-model , apollo , apollo-codegen-flow , apollo-codegen-scala , apollo-env , apollo-gateway , apollo-graphql , apollo-language-server , apollo-server , apollo-server-plugin-operation-registry , apollo-tooling , apollographql/apollo-client , aptos-core , aptos-labs-wallet-adapter-core , aptos-ts-sdk , astro , async-storage , augment-vir-assert , automatic-vendor-sharing , azure-sdk-for-js , babel-loader , berry , bl , blockchain-link-utils , browser-sync , browsers , buffer-image-size , bull-board-api , cacheable-lookup , centrifuge-js , chainsafe-libp2p-noise , chat , chrome-launcher , chromedriver , chromium-edge-launcher , clean-webpack-plugin , codeshift-core , colors-option , commitlint , confluent-kafka-javascript , connect-multichain , copy-webpack-plugin , core , cosmiconfig-typescript-loader , css-loader , css-minimizer-webpack-plugin , dax , decap-cms , definitelytyped , del , dev-middleware , developer-tooling , discord.js , discordjs/discord.js , docusaurus , docusaurus-babel , docusaurus-bundler , docusaurus-core , docusaurus-mdx-loader , docusaurus-module-type-aliases , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , docusaurus-types , docusaurus-utils , docusaurus-utils-common , docusaurus-utils-validation , dotansimha-graphql-yoga , ecosystem , editor , electron , ember-auto-import , ember-cli-babel , engine.io , esbuild-loader , eslint-plugin-formatjs , eslint-plugin-graphql , ethereum-cryptography , ethereumjs-account , ethereumjs-block , ethereumjs-client , ethereumjs-monorepo , ethereumjs-trie , ethereumjs-tx , ethereumjs-vm , ethereumjs-wallet , ethereumjs/ethereumjs-monorepo , expect , expect-webdriverio , expo , expo-application , expo-camera , expo-cli , expo-file-system , expo-glass-effect , expo-manifests , expo-metro-file-map , expo-module-scripts , expo-plugin-help , expo-updates , expo-updates-interface , expo-vector-icons , extract-css-chunks-webpack-plugin , extract-zip , facebook/jest , facebook/metro , federation , fetch , file-loader , file-system-cache , firebase , firebase-auth , firebase-functions , firebase-functions-compat , firebase-js-sdk , firebase-rules-unit-testing , firebase-storage , firebase-storage-compat , firestore-compat , fixturify , fork-ts-checker-webpack-plugin , formatjs-ts-transformer , friendly-errors-webpack-plugin , gateway , gatsby , gax-nodejs , get , get-workspaces , globby , google-cloud-artifact-registry , google-cloud-common , google-cloud-functions-framework , google-cloud-logging , google-cloud-node , google-cloud-storage , google-cloud-vertexai , got , got-cjs , graphile-engine , graphql-code-generator , graphql-code-generator-community , graphql-config , graphql-hive-envelop , graphql-hive-gateway-runtime , graphql-hive/console , graphql-language-service-server , graphql-live-queries , graphql-mesh , graphql-mesh-fusion-runtime , graphql-mesh-grpc , graphql-mesh-transport-grpc , graphql-sequelize , graphql-tools , graphql-tools-apollo-engine-loader , graphql-tools-executor-legacy-ws , graphql-tools-url-loader , graphql-upload , graphql-yoga , grpc-node , grpc-reflection-js , happy-dom , hard-source-webpack-plugin , hardhat , headers-polyfill , honeycomb-opentelemetry-js , hooks , html-webpack-plugin , http-proxy-middleware , huggingface-transformers , imagemin , inquirer-checkbox , inquirer-confirm , inquirer-core , inquirer-expand , inquirer-external-editor , inquirer-number , inquirer-password , inquirer-rawlist , inquirer-search , inquirer-select , inquirer-type , inquirer.js , ionic-cli , ionic-cli-framework , ionic-team/ionic-cli , ionic-utils-fs , ipx , istanbuljs-nyc-config-typescript , it-length-prefixed , it-protocol-buffers , jayson , jest , jest-axe , jest-changed-files , jest-console , jest-create-cache-key-function , jest-each , jest-leak-detector , jest-phabricator , jest-pnp-resolver , jest-preset-angular , jest-repl , jest-resolve , jest-serializer , jest-specific-snapshot , jest-test-result , jest-watch-typeahead , jest-watcher , js-genai , js-interfaces , js-libp2p , js-libp2p-bootstrap , js-libp2p-crypto , js-libp2p-kad-dht , js-multistream-select , js-peer-id , jsdoc-type-pratt-parser , jsdom , json-render , jwks-rsa , karma , karma-browserstack-launcher , karma-jasmine , karma-junit-reporter , karma-requirejs , kit , koa-body , koa-bodyparser , kubernetes-client-node , less-loader , libsql-client-ts , libsql-hrana-client , libsql-isomorphic-ws , lighthouse , localforage-asyncstorage-driver , log-process-errors , lottie-react-native , magic-js , magiclabs/magic-js , masked-view , material-ui , mem-fs , mem-fs-editor , meros , metamask-account-tree-controller , metamask-accounts , metamask-chomp-api-service , metamask-connect-solana , metamask-eth-snap-keyring , metamask-money-account-upgrade-controller , metamask-multichain-account-service , metamask-multichain-network-controller , metamask-multichain-transactions-controller , metamask-ramps-controller , metamask-snaps-cli , metamask-snaps-jest , metamask-snaps-rollup-plugin , metamask-snaps-simulation , metamask-snaps-webpack-plugin , metro , microsoft-365-agents-toolkit , mikro-orm , mini-css-extract-plugin , miniflare , minimizer-webpack-plugin , mobile-wallet-protocol , module-federation-core , module-federation/core , module-federation/vite , mongodb , mongodb-connection-string-url , mongoose , mqtt , mqtt-packet , msw , mysql2 , native-run , neondatabase-serverless , nest , nestjs-cache-manager , nestjs-cls , nestjs-platform-socket.io , nestjs-throttler , nestjs-websockets , netlify-build , netlify-cms , netlify-cms-app , netlify-cms-backend-gitlab , netlify-cms-core , netlify-cms-widget-markdown , netlify-dev , netlify-functions-dev , netlify-nuxt , netlify-opentelemetry-sdk-setup , netlify-runtime , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , netlify/functions , newrelic-security-agent , nguniversal , nitro , nomicfoundation-hardhat-ethers , npm:@aptos-labs/aptos-client , npm:@metamask/polling-controller , npm:@nestjs/sequelize , npm:@trezor/protobuf , null-loader , nuxt , oclif/core , office-addin-manifest , office-addin-scripts , ollama-ai-provider-v2 , omnigraph-grpc , onflow-fcl-react-native , onnxruntime-web , op-sqlite , open-wc , open-wc-semantic-dom-diff , open-wc-testing-karma , openai-agents-js , opencensus-node , openinference , opentelemetry-auto-instrumentations-node , opentelemetry-exporter-logs-otlp-grpc , opentelemetry-exporter-logs-otlp-http , opentelemetry-exporter-logs-otlp-proto , opentelemetry-exporter-metrics-otlp-grpc , opentelemetry-exporter-metrics-otlp-http , opentelemetry-exporter-metrics-otlp-proto , opentelemetry-exporter-trace-otlp-grpc , opentelemetry-exporter-trace-otlp-http , opentelemetry-exporter-trace-otlp-proto , opentelemetry-instrumentation-bunyan , opentelemetry-instrumentation-connect , opentelemetry-instrumentation-express , opentelemetry-instrumentation-hapi , opentelemetry-instrumentation-ioredis , opentelemetry-instrumentation-koa , opentelemetry-instrumentation-memcached , opentelemetry-instrumentation-mysql , opentelemetry-instrumentation-oracledb , opentelemetry-instrumentation-pg , opentelemetry-instrumentation-tedious , opentelemetry-js , opentelemetry-js-contrib , opentelemetry-operations-js , opentelemetry-otlp-exporter-base , opentelemetry-otlp-grpc-exporter-base , opentelemetry-otlp-proto-exporter-base , opentelemetry-sdk-node , optimism , otel , oven-sh/bun , parse5 , pigment-css , pkgs , playwright-core , playwright-test , plugin-commands , plugins , postcss-loader , postgraphile , posthog-react-native-plugin , prefresh-webpack , pretty-format , prettyhtml , primitives , proto-loader , proto3-json-serializer-nodejs , puppeteer , remark , remix , retry-request , rollup , rollup-plugin-node-resolve , rollup-plugin-sourcemaps , rollup-plugin-terser , rsbuild , rsbuild-core , rsbuild-plugin-css-minimizer , rsdoctor , rsdoctor-core , rsdoctor-graph , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-types , rsdoctor-utils , rspack , rules_nodejs , rushstack , rushstack-hashed-folder-copy-plugin , rushstack-heft-node-rig , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-lockfile-explorer , rushstack-webpack5-localization-plugin , rushstack-webpack5-module-minifier-plugin , sanity-cli-build , sanity-io/cli , sanity-workbench-cli , sass-loader , scalar , scalar/scalar , sdk-typescript , selenium-standalone , selfsigned , sentry-browser , sequelize , sequelize-typescript , services , sitemap , slack-logger , slack-socket-mode , slack-web-api , snaps , socket.io , sofa-api , solidjs-start , sort-package-json , source-map-loader , speedline , static-site-generator-webpack-plugin , storage , storybook , strong-error-handler , style-loader , style-resources-loader , subfont , sveltejs-adapter-bun , swarm-js , sync-request , tar-stream , teams.ts , tedious , terminus , testem , then-request , thread-loader , thrift-server , time-fix-plugin , toolkit , trezor-suite , ts-command-line , ts-jest , ts-loader , ts-node , tuql , types-accepts , types-bunyan , types-cli-progress , types-co-body , types-cookies , types-formidable , types-graceful-fs , types-jsonwebtoken , types-koa , types-koa-compose , types-memcached , types-mysql , types-oracledb , types-pbkdf2 , types-pg , types-pg-pool , types-readable-stream , types-recursive-readdir , types-request , types-set-cookie-parser , types-stream-buffers , types-tedious , types-through , types-vfile-message , types-yauzl , unctx , undici , unified , unocss , unocss-unocss , unocss-vite , unplugin , unstorage , url-loader , vanilla-extract , vechain-sdk-js , vercel , verdaccio , victory-native , vinxi , virmator , vite , vite-node , vite-plugin-basic-ssl , vite-plugin-svelte , vitefu , vitest , walletconnect-monorepo , walletconnect-utils , wdio-appium-service , wdio-cli , wdio-globals , wdio-repl , wdio-runner , wdio-types , web , web-dev-server , web-dev-server-core , web-dev-server-esbuild , web-dev-server-import-maps , web-dev-server-polyfill , web-dev-server-storybook , web-infra-dev/modern.js , web-mocks , web-test-runner-browserstack , web-test-runner-playwright , web-test-runner-saucelabs , web3.js , webdriverio , webpack , webpack-cli , webpack-cli-configtest , webpack-cli-generators , webpack-cli-info , webpack-cli-serve , webpack-dev-middleware , webpack-dev-server , webpack-subresource-integrity , webpackbar , whatwg-node , whatwg-node-fetch , wkx , worker-loader , workers-sdk , wry-context , wyw-in-js , xdm , xrpl-secret-numbers , yarnpkg-plugin-compat , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yarnpkg-sdks , yeoman-generator , yeoman/environment , zephyr-packages

Affected packages:

undici @ 7.25.0 (+4915 more)