undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Products covered
Microsoft Visual Studio 2026 version 18.10
Microsoft Visual Studio 2022 version 17.14
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 installed on Windows
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 installed on Linux
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 installed on Mac OS
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 installed on Windows
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 installed on Linux
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 installed on Mac OS
Remediation
Release Notes
Vendor-listed fixes
18.10.4
17.14.42
10.0.13
11.0.0-rc.2.26478.115
CVEs in this advisory 1
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.