Executive brief
cookies is a Node.js library used by the Koa framework to manage HTTP cookies. The library fails to properly validate domain and path options, allowing an attacker who can control these parameters to inject arbitrary cookie attributes such as SameSite, Secure, HttpOnly, or Domain. An application accepting user input for cookie domain or path settings could allow attackers to weaken cookie security restrictions or override critical protections.
Technical details
The vulnerability is a Set-Cookie attribute injection flaw (CWE-74) in the cookies library prior to version 0.9.2. While the library validates cookie names and values against a character set that rejects semicolons, the domain and path options are validated only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application passing untrusted or request-derived data into the domain or path options can inject additional cookie attributes, overriding security controls. The attack requires no authentication or user interaction and is network-accessible. The fix, available in cookies 0.9.2, validates domain and path against RFC 6265 character sets to prevent semicolon injection.
Affected products
- pillarjs cookies < 0.9.2
Timeline
- 2026-09-10: disclosed: CVE-2026-88038 published
- 2026-09-10: patched: cookies 0.9.2 released with fix