Description
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
Recommendation
Update the cookie package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.7.0
- Patched version(s): 0.7.0
References
Could your website be exposed too?
SmartScanner can check your website for cookie accepts cookie name, path, and domain with out of bounds characters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection - CVE-2026-44496
- Langchain Path Traversal vulnerability - CVE-2024-7774
- Path traversal in webpack-dev-middleware - CVE-2024-29180
- Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section - CVE-2024-47819
You might also like:
See something that needs correcting? Let us knowUpdated April 15, 2025