Node cookies: cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. (CVE-2026-88038)

The 'cookies' Node.js library prior to version 0.9.2 validates cookie names and values correctly to reject semicolons but applies only permissive RFC 7230 field-content validation to the domain and path options, which allows semicolons. These options are written unescaped into the Set-Cookie header, enabling an attacker who can supply untrusted or request-derived data in domain or path to inject additional cookie attributes. This can override security controls such as SameSite, Secure, HttpOnly, or Domain attributes on cookies issued by the application. The vulnerability is classified as a Set-Cookie attribute injection (CWE-74). The fix in version 0.9.2 enforces validation of domain and path against RFC 6265 character sets, preventing injection. As a mitigation, applications should ensure domain and path values are set by the application and not derived from untrusted input.

An attacker able to influence the domain or path options of cookies can inject additional Set-Cookie attributes, potentially weakening cookie security by overriding SameSite, Secure, HttpOnly, or Domain attributes. This could lead to cookie manipulation or theft scenarios depending on the application context. The CVSS 3.1 score is 4.8 (medium severity), reflecting limited impact with network attack vector, high attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Upgrade the 'cookies' library to version 0.9.2 or later, which includes proper validation of domain and path options against RFC 6265 character sets. As a workaround, ensure that domain and path options are set explicitly by the application and not derived from untrusted or request-supplied input to prevent injection of cookie attributes.