Set-Cookie Attribute Injection in Node.js Library Cookies Affecting Koa

CVE-2026-88038

What is CVE-2026-88038?

The cookies library for Node.js, utilized by Koa, suffers from a Set-Cookie attribute injection vulnerability in versions prior to 0.9.2. This issue arises because the library inadequately validates domain and path options against appropriate character sets, allowing attackers to inject arbitrary cookie attributes. As a result, untrusted data can manipulate critical cookie settings such as SameSite, Secure, HttpOnly, or Domain. The vulnerability has been addressed in version 0.9.2, which implements stricter validation per the RFC 6265 character set specifications. Users are advised to refrain from using untrusted input for setting domain or path options as a temporary measure.

References