CVE-2026-88038

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-88038

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88038.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-88038

Aliases

GHSA-x44v-5gxf-r6hf

Downstream

DEBIAN-CVE-2026-88038

Published

2026-09-10T12:11:58Z

Modified

2026-09-12T03:47:22Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

Details

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.

Database specific

{
    "cna_assigner": "openjs",
    "cwe_ids": [
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88038.json"
}

References

Affected packages

Git / github.com/pillarjs/cookies

Affected ranges

Type

GIT

Repo

https://github.com/pillarjs/cookies

Events

Introduced

Fixed

6e35de1524bb55d5deac3edcf67c2ac374d658d0

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*

0.4.0

0.4.1

0.5.0

0.5.1

0.6.0

0.6.1

0.6.2

0.7.0

0.7.1

0.7.2

0.7.3

0.8.0

0.9.0

0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88038.json"