A vulnerability in the @effect/platform library's makeCookie() function allows injection of cookie attributes via the name, domain, and path fields. These fields were validated with a regex that permitted the ';' character, enabling attackers to append arbitrary attributes to Set-Cookie headers. This can lead to unintended cookie scope expansion or attribute manipulation. The value field is safe due to encoding, and header splitting is not possible. The issue is fixed in versions 0.97.1 and 4.0.0-beta.103.