cookie accepts cookie name, path, and domain with out of bounds characters

Description

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.

Recommendation

Update the cookie package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.0
• Patched version(s): 0.7.0

References

• GHSA-pxg6-pf52-xh8x
• CVE-2024-47764
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection - CVE-2026-44496
• Langchain Path Traversal vulnerability - CVE-2024-7774
• Path traversal in webpack-dev-middleware - CVE-2024-29180
• Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section - CVE-2024-47819

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

cookie