Listen to this Post
How CVE-2026-16729 Works
The vulnerability exists within the `setCookie` function of the Undici HTTP client library for Node.js. This function is responsible for serializing cookie attributes into a valid `Set-Cookie` header. The flaw stems from insufficient sanitization in two specific areas, allowing an attacker to inject arbitrary cookie attributes.
The first injection path is in the domain validation. The `validateCookieDomain` function fails to reject semicolon (;) characters. In contrast, the related `validateCookiePath` function correctly blocks this character (using the hexadecimal value 0x3B). As a result, if an application passes a user-controlled domain value like example.com; SameSite=None, the function accepts it without sanitization. This value is then directly embedded into the `Set-Cookie` header as Domain=example.com; SameSite=None. This allows an attacker to inject a `SameSite=None` attribute, which can be used to bypass CSRF protections that rely on the `SameSite` policy.
The second path lies in the handling of the `unparsed` array. The `setCookie` function iterates over this array, but its validation only checks if each entry contains an equals sign (=). It does not perform any further sanitization of the values. Consequently, an attacker can provide an entry like X-Custom=val; HttpOnly. This string is inserted into the `Set-Cookie` header without modification, effectively injecting the `HttpOnly` attribute even if the application’s code did not explicitly set cookie.httpOnly = true. This can alter the cookie’s visibility to client-side scripts.
The primary risk is for multi-tenant applications or reverse-proxy servers that accept user or tenant-supplied input (like a domain name) and pass it directly to the `setCookie` function. By exploiting these injection paths, an attacker can force or strip `Secure` and `HttpOnly` flags, override the intended `SameSite` policy, and effectively manipulate the security attributes of session cookies.
DailyCVE Form
Platform: Node.js
Version: <6.28.0, 7.0.0-7.28.0, 8.0.0-8.8.0
Vulnerability : Cookie Attribute Injection
Severity: Moderate
date: 2026-07-29
Prediction: 2026-08-03
What Undercode Say
Analytics show the vulnerability is triggered by insufficient sanitization in `validateCookieDomain` and the `unparsed` loop.
To check your version, use:
npm list undici
To see the vulnerable code paths, inspect:
grep -r "validateCookieDomain" node_modules/undici/lib/web/cookies/util.js grep -r "unparsed" node_modules/undici/lib/web/cookies/util.js
Exploit
An attacker can exploit this by injecting a semicolon into the `domain` parameter.
// Vulnerable domain input
const userDomain = "example.com; SameSite=None";
setCookie({ name: 'session', value: 'abc', domain: userDomain });
// Resulting header: Set-Cookie: session=abc; Domain=example.com; SameSite=None
Alternatively, they can exploit the `unparsed` field.
// Vulnerable unparsed input
const userUnparsed = ["X-Custom=val; HttpOnly"];
setCookie({ name: 'session', value: 'abc', unparsed: userUnparsed });
// Resulting header: Set-Cookie: session=abc; X-Custom=val; HttpOnly
Protection
Upgrade to a patched version: v6.28.0, v7.29.0, v8.9.0, or higher.
As a workaround, sanitize any user-controlled `domain` values against the RFC 1034 letter-digit-hyphen set before passing them to setCookie. Additionally, avoid passing any user-controlled data to the `unparsed` field.
Impact
Successful exploitation allows an attacker to inject or override cookie attributes like SameSite, Secure, and `HttpOnly. This can lead to the bypass of Cross-Site Request Forgery (CSRF) protections, the stripping of security flags intended to protect the cookie, or the forced addition of attributes that weaken the cookie’s security posture.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
