CVE-2026-16729 describes a vulnerability in the undici HTTP client library's setCookie function, which has two injection paths for cookie attributes. The validateCookieDomain function fails to reject semicolons in domain values, allowing injection of additional cookie attributes like SameSite=None. Additionally, the unparsed array loop only checks for '=' presence but does not sanitize values, permitting injection of attributes such as HttpOnly without the caller explicitly setting them. This can cause security attributes to be forced, stripped, or overridden, potentially bypassing SameSite CSRF protections. The vulnerability primarily impacts applications passing user-controlled input to these fields, such as multi-tenant or reverse-proxy servers. Official patches are available in undici versions 6.28.0, 7.29.0, and 8.9.0.

The vulnerability allows attackers to inject arbitrary cookie attributes via unsanitized domain and unparsed setCookie fields. This can lead to bypassing SameSite CSRF protections, forcibly setting or stripping Secure or HttpOnly flags, or overriding intended SameSite cookie tiers. The impact is limited to scenarios where user-controlled input is passed to these cookie attributes, commonly in multi-tenant or reverse-proxy server contexts. The CVSS 3.1 base score is 4.8 (medium severity), reflecting network attack vector with high attack complexity and no privileges or user interaction required, causing limited confidentiality and integrity impact without availability impact.

A fix is available in undici versions 6.28.0, 7.29.0, and 8.9.0. Users should upgrade to one of these patched versions to remediate the vulnerability. As a workaround, sanitize domain values against the RFC 1034 letter-digit-hyphen set before passing them to setCookie, and avoid passing user-controlled data to the unparsed field. These mitigations reduce the risk until upgrading is possible.