Cookies
Monthly
Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.
Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.