Skip to main content

undici EUVDEUVD-2026-50416

| CVE-2026-16729 MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2026-07-29 ce714d77-add3-4f53-aff5-83d477b104bb GHSA-v3r7-h72x-cjcm
CSRF Node.js Red Hat Undici Suse
6.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (ce714d77-add3-4f53-aff5-83d477b104bb) PRIMARY
MEDIUM
qualitative
NVD
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
4.8 MEDIUM

Network-reachable injection, but AC:H because exploitation requires the application to pass user input to setCookie domain; partial C and I from cookie attribute manipulation enabling CSRF; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
4.8 MEDIUM
qualitative

Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
CVSS changed
Aug 05, 2026 - 15:22 NVD
4.8 (MEDIUM) 6.5 (MEDIUM)
Patch available
Jul 29, 2026 - 18:17 EUVD
Analysis Generated
Jul 29, 2026 - 17:31 vuln.today
CVE Published
Jul 29, 2026 - 17:16 cve.org
MEDIUM 4.8

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 28 npm packages depend on undici (16 direct, 23 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

AnalysisAI

Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array entries to silently append, strip, or override attributes such as SameSite, HttpOnly, and Secure. Affected are all undici releases before 6.28.0, the 7.x branch before 7.29.0, and the 8.x branch before 8.9.0. In multi-tenant or reverse-proxy deployments that scope session cookies to tenant-supplied domains, this flaw enables CSRF protection bypass by downgrading or overriding the SameSite attribute, with no public exploit identified at time of analysis.

Technical ContextAI

undici is a Node.js HTTP/1.1 client library integrated directly into Node.js core since v18, widely used for server-side HTTP requests. Its setCookie function constructs Set-Cookie header values, but fails to reject or escape semicolons in the domain parameter - the semicolon being the delimiter that separates cookie attribute pairs in the header. A domain value like 'tenant.example.com; SameSite=None' is parsed by browsers as two distinct directives: the domain assignment and an injected SameSite attribute. A parallel path exists via unsanitized entries in the unparsed cookie array, which allows raw attribute strings such as 'HttpOnly' to be appended without the calling application having set them. CWE-74 (Injection) captures the root cause: structured output (a cookie header) is constructed from untrusted input without sanitizing the special characters that carry structural meaning in that format.

RemediationAI

Upgrade undici to the patched release for your active version branch: 6.28.0, 7.29.0, or 8.9.0, as confirmed by the OpenJS Foundation advisory at https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm. If an immediate upgrade is not feasible, the most effective compensating control is to validate and reject any user-supplied domain value that contains a semicolon before it reaches setCookie - this can be enforced with a simple allowlist or regex check at the application boundary. Similarly, avoid passing unsanitized external data through the unparsed cookie array. Restricting tenant-supplied domain input to a pre-approved list of hostnames eliminates the attack surface entirely with no functional side effects for well-structured multi-tenant configurations. Generic WAF rules are unlikely to be effective here since the injection occurs server-side within the Node.js process, not in HTTP request parsing.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

EUVD-2026-50416 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy