CVE-2026-16729: undici setCookie CSRF Bypass Vulnerability

CVE-2026-16729 Overview

CVE-2026-16729 affects undici, the HTTP/1.1 client used by Node.js. The setCookie function does not fully sanitize cookie attributes before serialization. A domain value is not checked for semicolons, and entries in the unparsed array are passed through without sanitization. Attacker-influenced input can inject additional cookie attributes such as SameSite, HttpOnly, or Secure. The flaw is tracked under [CWE-74] (improper neutralization of special elements in output).

Critical Impact
Applications passing user-controlled input to cookie fields, including multi-tenant or reverse-proxy servers that scope session cookies by tenant, can have SameSite CSRF protections bypassed and Secure, HttpOnly, or SameSite attributes forced, stripped, or overridden.

Affected Products

undici versions before 6.28.0
undici versions 7.0.0 up to before 7.29.0
undici versions 8.0.0 up to before 8.9.0

Discovery Timeline

2026-07-29 - CVE-2026-16729 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-16729

Vulnerability Analysis

The undici library exposes a setCookie helper that serializes cookie objects into Set-Cookie header values. The serializer trusts caller-supplied values for the domain field and for elements of the unparsed array. Neither input is checked for the ; delimiter that separates cookie attributes. An attacker who influences these fields can terminate the intended attribute and append arbitrary attributes to the header.

For example, a domain value of tenant.example.com; SameSite=None produces a header where SameSite=None becomes an independent attribute the caller never set. Similar injection is possible through unparsed entries, which can add HttpOnly, Secure, or overrides for existing attributes.

The attack requires the calling application to route untrusted input into setCookie. Multi-tenant platforms and reverse proxies that derive cookie scope from a tenant-supplied hostname are the primary risk surface. Successful injection weakens or removes browser-side session protections, enabling downstream CSRF, session fixation, or client-side theft of session identifiers.

Root Cause

The setCookie function concatenates attribute values directly into the header string without escaping or rejecting the ; separator. The unparsed array is intended for pass-through of pre-formatted attribute segments, but no validation confirms that each entry represents a single, well-formed attribute.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker submits crafted input, typically a hostname or header value, to an application that forwards it into a cookie attribute. The malicious payload embeds a semicolon followed by additional attributes. The resulting Set-Cookie header is returned to victim browsers, which honor the injected attributes as legitimate.

No verified proof-of-concept code is public. Technical detail is available in the GitHub Security Advisory GHSA-v3r7-h72x-cjcm and the OpenJS Foundation Security Advisories.

Detection Methods for CVE-2026-16729

Indicators of Compromise

Set-Cookie response headers containing unexpected SameSite, HttpOnly, or Secure attributes on cookies whose application code never sets them.
Cookie Domain attribute values that contain literal ; characters or trailing attribute-like tokens.
Web application logs showing tenant identifiers or hostnames containing ;, =, or whitespace before reaching cookie serialization.

Detection Strategies

Inventory Node.js services and enumerate installed undici versions using npm ls undici across production dependency trees.
Add HTTP response inspection at the egress proxy to flag Set-Cookie headers with duplicated attribute names or malformed structure.
Audit application source for direct or indirect calls to setCookie that pass request-derived data into the domain field or the unparsed array.

Monitoring Recommendations

Log all outbound Set-Cookie headers from multi-tenant gateways and alert on attribute values containing ; after the first delimiter.
Monitor dependency manifests in CI for undici versions below the fixed releases and fail builds until upgraded.
Track anomalous CSRF or session-related failures that may indicate SameSite downgrade in production traffic.

How to Mitigate CVE-2026-16729

Immediate Actions Required

Upgrade undici to 6.28.0, 7.29.0, or 8.9.0 or later depending on the branch in use.
Rebuild and redeploy all Node.js applications and container images that pin an affected undici version, including transitive dependencies.
Review server-side code that constructs cookie objects to confirm no user-controlled input is passed into the domain field or the unparsed array.

Patch Information

The issue is fixed in undici6.28.0, 7.29.0, and 8.9.0. Refer to the GitHub Security Advisory GHSA-v3r7-h72x-cjcm for the patch commits and version metadata.

Workarounds

Validate that any hostname or tenant identifier used for cookie scoping matches a strict allowlist regex such as ^[a-z0-9.-]+$ before passing it to setCookie.
Reject or strip ;, =, whitespace, and control characters from any string that will populate a cookie attribute.
Avoid using the unparsed array for values derived from external input; construct attributes through typed fields on the cookie object instead.

bash

# Configuration example
npm install undici@^8.9.0
npm ls undici