CVE-2026-16729 vulnerabilities

Vulnerabilities for packages: vitess, langfuse, pulumi, saf, code-server, prism, renovate, npm...

CVE-2026-16729 vulnerabilities

Vulnerabilities for packages: saf, pulumi, renovate, pelias-api, langfuse-fips, vitess, langfuse, code-server, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, kibana, actions-runner, npm, prism...

DEBIAN-CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...

CVE-2026-16729

undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...