{"id":"AZL-94443","summary":"CVE-2026-16729 affecting package nodejs 24.18.1-1","details":"undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.","modified":"2026-08-30T05:26:50Z","published":"2026-07-29T17:16:51Z","upstream":["CVE-2026-16729"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729"}],"affected":[{"package":{"name":"nodejs","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/nodejs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.18.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94443.json"}}],"schema_version":"1.9.0"}