CVE-2026-16729

Microsoft · Published August 7, 2026

4.8

CVSS v3.1

MEDIUM

Patch availableGet patch

Description

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields. undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

Affected Products

azl3 nodejs 24.18.1-1 on Azure Linux 3.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N