Node js cookie: Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. (CVE-2026-46625)

The vulnerability in node-js-cookie before version 3.0.7 arises from the assign() helper copying properties with for...in and plain assignment. When the source object is derived from JSON.parse, the __proto__ property is enumerable and copied, causing a per-instance prototype hijack on the merged attributes object. This hijack allows an attacker to inject arbitrary cookie attributes that the developer intended to be fixed, such as domain, secure, samesite, expires, and path. This can lead to manipulation of cookie behavior. The vulnerability is addressed in version 3.0.7.

The vulnerability enables an attacker to control cookie attributes by injecting properties into the prototype of the merged attributes object. This can result in unauthorized modification of cookie parameters like domain and security flags, potentially undermining cookie security policies. There is no direct confidentiality or availability impact reported. The CVSS score is 7.5 (high impact on integrity).

Upgrade node-js-cookie to version 3.0.7 or later, where this prototype pollution vulnerability is fixed. No other mitigation is indicated by the vendor advisory.