https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 06 Aug 2026 10:28:31 +0000 https://vulnerability.circl.lu/sighting/a2864bcb-a4a1-4d69-ba08-72c058607ece/export {"uuid": "a2864bcb-a4a1-4d69-ba08-72c058607ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://gist.github.com/alon710/95d41625eb91d5b304c0c5ed76c502de", "content": "# CVE-2026-16729: CVE-2026-16729: Cookie Attribute Injection in Undici via Unsanitized Domain and Unparsed Fields\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-16729\n\n## Summary\nCVE-2026-16729 (GHSA-v3r7-h72x-cjcm) is a medium-severity cookie attribute injection vulnerability in Undici's web-compliant cookie utility module. Due to insufficient validation of domain parameters and raw attributes in the unparsed options array, arbitrary attributes like SameSite, HttpOnly, and Secure can be injected. This allows attackers to bypass CSRF protections, strip security flags, or override intended cookie behaviors when applications pass user-controlled values to these properties.\n\n## TL;DR\nA vulnerability in Undici allows remote attackers to inject arbitrary cookie attributes (such as SameSite, HttpOnly, and Secure) via unsanitized domain inputs and custom unparsed options arrays, undermining core web-security mitigations like CSRF protections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.8\n- **Exploit Status**: poc\n- **CISA KEV Status**: No\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Undici HTTP Client (Node.js)\n- **undici**: < 6.28.0 (Fixed in: `6.28.0`)\n- **undici**: >= 7.0.0 < 7.29.0 (Fixed in: `7.29.0`)\n- **undici**: >= 8.0.0 < 8.9.0 (Fixed in: `8.9.0`)\n\n## Mitigation\n\n- Upgrade Undici to patched versions (6.28.0, 7.29.0, or 8.9.0).\n- Sanitize and validate user-supplied domains at the application layer using strict RFC 1123 compliance checks.\n- Block semicolon (`;`) characters in any user inputs mapped directly to HTTP headers or cookie options.\n- Implement deep validation on keys and values populated into the custom `unparsed` cookie configuration array.\n\n**Remediation Steps:**\n1. Identify the active version of Undici inside your project environment using commands like `npm ls undici` or `yarn why undici`.\n2. Upgrade Undici to the latest secure version: run `npm install undici@latest` or configure an explicit dependency override in package.json.\n3. Implement application-level sanitization filters on all domain inputs used in cookie configurations.\n4. Deploy code fixes and perform automated integration testing to ensure cookie header structures remain intact.\n\n## References\n\n- [GHSA-v3r7-h72x-cjcm Security Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-16729)\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-16729)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-16729)\n- [Undici Release v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0)\n- [Undici Release v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0)\n- [Undici Release v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-16729) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T13:32:13.639360Z"} {"uuid": "a2864bcb-a4a1-4d69-ba08-72c058607ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://gist.github.com/alon710/95d41625eb91d5b304c0c5ed76c502de", "content": "# CVE-2026-16729: CVE-2026-16729: Cookie Attribute Injection in Undici via Unsanitized Domain and Unparsed Fields\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-16729\n\n## Summary\nCVE-2026-16729 (GHSA-v3r7-h72x-cjcm) is a medium-severity cookie attribute injection vulnerability in Undici's web-compliant cookie utility module. Due to insufficient validation of domain parameters and raw attributes in the unparsed options array, arbitrary attributes like SameSite, HttpOnly, and Secure can be injected. This allows attackers to bypass CSRF protections, strip security flags, or override intended cookie behaviors when applications pass user-controlled values to these properties.\n\n## TL;DR\nA vulnerability in Undici allows remote attackers to inject arbitrary cookie attributes (such as SameSite, HttpOnly, and Secure) via unsanitized domain inputs and custom unparsed options arrays, undermining core web-security mitigations like CSRF protections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.8\n- **Exploit Status**: poc\n- **CISA KEV Status**: No\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Undici HTTP Client (Node.js)\n- **undici**: < 6.28.0 (Fixed in: `6.28.0`)\n- **undici**: >= 7.0.0 < 7.29.0 (Fixed in: `7.29.0`)\n- **undici**: >= 8.0.0 < 8.9.0 (Fixed in: `8.9.0`)\n\n## Mitigation\n\n- Upgrade Undici to patched versions (6.28.0, 7.29.0, or 8.9.0).\n- Sanitize and validate user-supplied domains at the application layer using strict RFC 1123 compliance checks.\n- Block semicolon (`;`) characters in any user inputs mapped directly to HTTP headers or cookie options.\n- Implement deep validation on keys and values populated into the custom `unparsed` cookie configuration array.\n\n**Remediation Steps:**\n1. Identify the active version of Undici inside your project environment using commands like `npm ls undici` or `yarn why undici`.\n2. Upgrade Undici to the latest secure version: run `npm install undici@latest` or configure an explicit dependency override in package.json.\n3. Implement application-level sanitization filters on all domain inputs used in cookie configurations.\n4. Deploy code fixes and perform automated integration testing to ensure cookie header structures remain intact.\n\n## References\n\n- [GHSA-v3r7-h72x-cjcm Security Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-16729)\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-16729)\n- [Wiz Vulnerability Database entry](https://www.wiz.io/vulnerability-database/cve/cve-2026-16729)\n- [Undici Release v6.28.0](https://github.com/nodejs/undici/releases/tag/v6.28.0)\n- [Undici Release v7.29.0](https://github.com/nodejs/undici/releases/tag/v7.29.0)\n- [Undici Release v8.9.0](https://github.com/nodejs/undici/releases/tag/v8.9.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-16729) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T13:32:13.639360Z"} https://vulnerability.circl.lu/sighting/a2864bcb-a4a1-4d69-ba08-72c058607ece/export Tue, 04 Aug 2026 13:32:13 +0000 https://vulnerability.circl.lu/sighting/a81fa453-6fe4-4353-abb3-9901aca7e91b/export {"uuid": "a81fa453-6fe4-4353-abb3-9901aca7e91b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxodedyc2o", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-16729 impacts undici in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/646\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:01:04.317077Z"} {"uuid": "a81fa453-6fe4-4353-abb3-9901aca7e91b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msaxodedyc2o", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-16729 impacts undici in 2 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/646\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-08-04T12:01:04.317077Z"} https://vulnerability.circl.lu/sighting/a81fa453-6fe4-4353-abb3-9901aca7e91b/export Tue, 04 Aug 2026 12:01:04 +0000 https://vulnerability.circl.lu/sighting/1ca49bfa-e1dd-4381-b876-ade08d2e5df2/export {"uuid": "1ca49bfa-e1dd-4381-b876-ade08d2e5df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mrsezgdb522c", "content": "\ud83d\udea8 Medium-severity security fix in undici@6.28.0, 7.29.0, and 8.9.0 just released!\n\nPatches CVE-2026-16729: cookie attribute injection via unsanitized domain and unparsed setCookie fields\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-07-29T16:49:58.333262Z"} {"uuid": "1ca49bfa-e1dd-4381-b876-ade08d2e5df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16729", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mrsezgdb522c", "content": "\ud83d\udea8 Medium-severity security fix in undici@6.28.0, 7.29.0, and 8.9.0 just released!\n\nPatches CVE-2026-16729: cookie attribute injection via unsanitized domain and unparsed setCookie fields\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-07-29T16:49:58.333262Z"} https://vulnerability.circl.lu/sighting/1ca49bfa-e1dd-4381-b876-ade08d2e5df2/export Wed, 29 Jul 2026 16:49:58 +0000