Intel

CVE-2026-16729

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

mediumEPSS 0.2%

Description

A flaw was found in undici, where its `setCookie` function does not fully sanitize cookie attributes. A remote attacker could exploit this by providing specially crafted input to the `domain` or `unparsed` fields, leading to the injection of additional cookie attributes. This vulnerability can allow an attacker to bypass Cross-Site Request Forgery (CSRF) protections or manipulate critical cookie attributes like `Secure` and `HttpOnly`, potentially compromising user sessions or data integrity in applications such as multi-tenant or reverse-proxy servers.

Source: REDHAT_CSAFREDHAT_CSAFOSVMSRCCVELISTV5NVD

Metrics

Severity
medium
Priority score
99.82
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
6.5
Source: nvd-v3
CVSS v3
4.8
CVSS v4
—
EPSS percentile
8.8 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-30 03:14 UTC
CWE
CWE-74

Weakness classes (CWE)

  • CWE-74Class

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-08-05 15:18 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    • CPE Configuration: OR *cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* versions from (including) 7.0.0 up to (excluding) 7.29.0 *cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* versions from (including) 8.0.0 up to (excluding) 8.9.0 *cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:* versions up to (excluding) 6.28.0
    • Reference Type: openjs: https://cna.openjsf.org/security-advisories.html Types: Vendor Advisory
    • Reference Type: openjs: https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm Types: Vendor Advisory
  2. New CVE Received2026-07-29 17:16 UTC· ce714d77-add3-4f53-aff5-83d477b104bb
    • Affected: undici
    • Description: undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.
    • CVSS V3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
    • CWE: CWE-74

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • bitnami

    node-min23.0.0

  • bitnami

    node-min25.0.0

  • nodejs

    undici7.0.0 – 7.29.0

  • nodejs

    undici8.0.0 – 8.9.0

  • nodejs

    undici6.28.0

  • npm

    undici7.0.0

  • npm

    undici8.0.0

  • npm

    undici

References & sources

Linked CVEs

IDCVE-2026-16729