cookie accepts cookie name, path, and domain with out of bounds characters

Description

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.

Recommendation

Update the cookie package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.0
• Patched version(s): 0.7.0

References

• GHSA-pxg6-pf52-xh8x
• CVE-2024-47764
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• `vega-functions` vulnerable to Cross-site Scripting via `setdata` function - CVE-2025-66648
• @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388
• MongoDB Shell may be susceptible to control character injection via pasting - CVE-2025-1692
• Strapi's field level permissions not being respected in relationship title - CVE-2023-37263

Tags:

npm

cookie