CVE-2026-88038 in cookies
Summary
by MITRE • 09/10/2026
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The cookies library for Node.js serves as a foundational component for managing HTTP cookie operations within the Koa web framework through its context object. In versions prior to 0.9.2, this library exhibits a critical inconsistency in how it validates different components of a Set-Cookie header. Specifically, while the validation logic correctly rejects semicolons when processing cookie names and values based on strict character sets, it applies a significantly more permissive validation strategy for the domain and path options. This discrepancy arises because the domain and path fields are checked against an RFC 7230 field-content matcher rather than the stricter requirements defined in RFC 6265 for cookies. The RFC 7230 standard allows semicolons within field content, which is appropriate for general HTTP headers but dangerous when constructing cookie attributes that rely on semicolons as delimiters between distinct key-value pairs or flags.
This architectural flaw leads to a Set-Cookie attribute injection vulnerability, classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Web Component. When an application utilizes the cookies library and passes untrusted data, such as input derived directly from user requests, into the domain or path options, it inadvertently enables attackers to inject additional cookie attributes. Because these values are written into the Set-Cookie header without escaping semicolons, an attacker can insert characters that break out of the intended field boundaries. For instance, by injecting a string containing a semicolon followed by specific keywords like SameSite=Strict or Secure=false, an attacker can override security-critical flags set by the application itself. This effectively allows the manipulation of how browsers handle session cookies, potentially bypassing protections designed to prevent cross-site request forgery or ensure transmission over secure channels only.
The operational impact of this vulnerability is severe as it undermines several key browser-side cookie security mechanisms. If an attacker can override the SameSite attribute, they may facilitate Cross-Site Request Forgery attacks by forcing browsers to send session cookies in cross-origin contexts where they would otherwise be blocked. Similarly, overriding the Secure flag could allow sensitive data to be transmitted over unencrypted HTTP connections, exposing it to network eavesdropping and man-in-the-middle attacks. Furthermore, manipulating the HttpOnly attribute might expose application logic or internal state information by allowing client-side scripts to access cookies that were intended to be inaccessible to JavaScript. The Domain override can also lead to cookie leakage across different subdomains or even unrelated domains if not carefully constrained, expanding the attack surface for session hijacking attempts.
To mitigate this vulnerability, developers must ensure they are using version 0.9.2 or later of the cookies library, which corrects the validation logic by enforcing RFC 6265 character sets on domain and path options, thereby rejecting semicolons in these fields just as it does for names and values. For applications that cannot immediately upgrade due to dependency constraints, a robust workaround involves strictly controlling how domain and path attributes are determined. Developers should avoid deriving these values from untrusted request data such as headers or query parameters. Instead, the application logic should hardcode or derive these settings from trusted internal configuration sources. This approach ensures that even if an attacker controls input fields used elsewhere in the request processing pipeline, they cannot influence the structural integrity of the Set-Cookie header through attribute injection. Adhering to these practices aligns with broader security standards and helps maintain the confidentiality and integrity of user sessions managed by web applications.