CVE-2026-16729

In undici before versions 6.28.0, 7.29.0, and 8.9.0, the 'type' property of hand-rolled blob-like request bodies is not validated. An attacker can inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles optional whitespace around the equals sign in Cache-Control directives. This can cause authenticated user data to be cached and served to other users.

In undici before versions 6.28.0, 7.29.0, and 8.9.0, the retry interceptor can deliver a response whose body length does not match the Content-Length header, potentially leading to response desynchronization, connection hangs, or response corruption.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles malformed Cache-Control private directives. A response with a private directive set to an empty value can be stored in the shared cache and served to other users, disclosing private data. Additionally, combining an unqualified and qualified private directive causes a TypeError that can crash the process.

A vulnerability in the undici library causes the requestTls option to be silently dropped when using ProxyAgent with a SOCKS5 proxy. The HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store instead of user-configured settings.

Undici's cookie parser (parseSetCookie) decodes cookie values, which can lead to HTTP response header injection. Applications that forward parsed cookie values into response headers become vulnerable to attacks such as session fixation or malicious redirects.

A vulnerability in Undici allows incorrect classification of responses as cacheable when Cache-Control headers contain whitespace. This can lead to authenticated user data being served to another user from the cache.

In the undici library, a vulnerability allows Socks5ProxyAgent to reuse a single connection pool across different origins without verifying origin match. This causes cross-origin request routing, credential leakage, and potential HTTPS downgrade to HTTP.

A vulnerability in undici allows the acceptance of incorrect SameSite attribute values in the Set-Cookie header, potentially leading to a weakening of the cookie's SameSite policy. Instead of the required case-insensitive exact match, values containing 'Strict', 'Lax', or 'None' as substrings are accepted.

The undici WebSocket client does not limit the number of message fragments, allowing a malicious server to send many small continuation frames. This causes unbounded memory growth and denial of service (DoS).