CVE-2026-16729 (MEDIUM): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-16729](https://avd.aquasec.com/nvd/cve-2026-16729) | `MEDIUM` | `undici` | `6.26.0` | `6.28.0, 7.29.0, 8.9.0` | `2026-07-29T17:16:51.123Z` | `2026-08-04T10:19:08.862184301Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/nodejs:latest` | `public.ecr.aws/lambda/nodejs@sha256:fe69820efd000f4a6a34af1fc61ad476e8266f14fa8ebde7688564efba67a2df` |
| `public.ecr.aws/lambda/nodejs:24` | `public.ecr.aws/lambda/nodejs@sha256:fe69820efd000f4a6a34af1fc61ad476e8266f14fa8ebde7688564efba67a2df` |

---

## Description

> undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0.

---

### Remediation Steps
- Update the affected package `undici` from version `6.26.0` to `6.28.0, 7.29.0, 8.9.0`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Start by locating how the public.ecr.aws/lambda/nodejs:latest and :24 images obtain the undici package, then check the installed version against the affected 6.26.0 version listed here. Done means the images use a fixed undici release and a subsequent vulnerability scan no longer reports CVE-2026-16729.

Written by the indexing model from the issue text.