Source: node-cookies Version: 0.9.1+~0.9.2-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for node-cookies. CVE-2026-88038[0]: | cookies is a Node.js library for reading and writing HTTP cookies, | used by Koa via ctx.cookies. In versions before 0.9.2 the library | validates the cookie name and value against character sets that | reject the semicolon separator, but the domain and path options are | checked only against a permissive RFC 7230 field-content matcher | that allows semicolons, and both are written into the Set-Cookie | header unescaped. An application that passes untrusted or request- | derived data into the domain or path option can therefore inject | additional cookie attributes, overriding SameSite, Secure, HttpOnly, | or Domain on the cookies the application issues. This is a Set- | Cookie attribute injection issue (CWE-74). The issue is fixed in | cookies 0.9.2, which validates domain and path against RFC 6265 | character sets. As a workaround, keep domain and path application- | set rather than derived from untrusted input. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-88038 https://www.cve.org/CVERecord?id=CVE-2026-88038 [1] https://github.com/pillarjs/cookies/security/advisories/GHSA-x44v-5gxf-r6hf [2] https://github.com/pillarjs/cookies/commit/edf9512022d710dea2a1acca2dc215fa9ff7900c Please adjust the affected versions in the BTS as needed. Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
