CVE-2026-88038: cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cookiesto a version that resolves this vulnerability.Fixed in 0.9.2 - Configuration
As a workaround, keep cookie Domain and Path application-set rather than derived from untrusted input, since untrusted/request-derived data can inject additional Set-Cookie attributes (overriding SameSite, Secure, HttpOnly, or Domain).
Application using cookies/ctx.cookies cookie domain and path options = Set domain and path using application-defined values (not derived from untrusted/request-derived input)
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using versions of the npm cookies library before 0.9.2 are exposed only if they pass untrusted or request-derived data into the cookie domain or path options. Applications that set those options solely from fixed application-controlled values are not described as vulnerable to this injection path.
What can an attacker do if they can influence a domain or path option?
They can use semicolons in the supplied value to inject additional Set-Cookie attributes. This can override attributes such as SameSite, Secure, HttpOnly, or Domain on cookies issued by the application.
What should be done if upgrading is not immediately possible?
Keep cookie domain and path values application-set and do not derive them from untrusted input. Upgrading to cookies 0.9.2 fixes the issue by validating these options against RFC 6265 character sets.