CVE-2026-88038
Awaiting Analysis Awaiting Analysis - Queue

Cookies Library Set-Cookie Attribute Injection Vulnerability

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: openjs

Description
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-88038
EUVD
EUVD-2026-75398

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88038 is a Set-Cookie attribute injection vulnerability in the Node.js 'cookies' library versions before 0.9.2. It occurs because domain and path options are validated against a permissive matcher allowing semicolons, enabling attackers to inject additional cookie attributes like SameSite, Secure, HttpOnly, or Domain by passing untrusted data into these fields.

Detection Guidance

To detect this vulnerability, check if your application uses the 'cookies' npm package version prior to 0.9.2. Run 'npm list cookies' to see the installed version. If the version is below 0.9.2, the system is vulnerable. Additionally, inspect application code for untrusted input passed to domain or path options in cookie settings.

Impact Analysis

This vulnerability allows attackers to override security-related cookie attributes such as SameSite, Secure, HttpOnly, or Domain. This could lead to session hijacking, unauthorized access, or bypassing security controls if untrusted input is passed into domain or path options.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing attackers to inject malicious cookie attributes. This may override security-related settings like HttpOnly or Secure, which are critical for protecting sensitive data such as user credentials or health information. Unauthorized access to such data could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately upgrade the 'cookies' package to version 0.9.2 or later using 'npm update cookies'. As a temporary workaround, avoid passing untrusted or request-derived data into domain or path options in cookie settings until upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart