EUVD-2026-75398Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H captures the mandatory application-level antipattern; C:L/I:L reflects indirect attribute-override impact enabling follow-on attacks rather than direct data loss.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.
AnalysisAI
Set-Cookie attribute injection in the cookies Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the domain or path option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via ctx.cookies) represent the primary at-risk population. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application passes untrusted or request-derived data - such as a URL path segment, a Host header value, or a query parameter - directly into the `domain` or `path` option of a `cookies.set()` call using a `cookies` library version earlier than 0.9.2. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately characterises a real but highly conditional threat: exploitation requires an application-level antipattern - passing untrusted or request-derived data into the `domain` or `path` cookie option - rather than a flaw exploitable against all consumers of the library. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the `cookies` npm package to version 0.9.2 or later, which enforces RFC 6265 character-set validation on the `domain` and `path` options and will reject values containing semicolons. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today