cookie accepts cookie name, path, and domain with out of bounds characters

Description

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.

Recommendation

Update the cookie package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.0
• Patched version(s): 0.7.0

References

• GHSA-pxg6-pf52-xh8x
• CVE-2024-47764
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388
• Strapi's field level permissions not being respected in relationship title - CVE-2023-37263
• Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS - CVE-2024-45812
• ag-grid packages vulnerable to Prototype Pollution (GHSA-328p-362g-r48j) 2 - CVE-2024-39001

Tags:

npm

cookie