Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-88038— cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

Quick assessment

Affected
cookies cookies
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个用于读写 HTTP Cookie 的 Node.js 库，Koa 框架通过 使用了该库。在 0.9.2 版本之前，该库对 Cookie 的名称和值进行验证，使用的字符集会拒绝分号分隔符；然而，对 和 选项的验证仅基于较为宽松的 RFC 7230 field-content 匹配器，该匹配器允许使用分号，且这两个选项会被未经转义地直接写入 响应头中。因此，如果应用程序将不可信或源自请求的数据传入 或 选项，攻击者便可注入额外的 Cookie 属性，从而覆盖应用程序所颁发 Cookie 的 、 、 或 等属性。这

CVSS 4.8 · Medium EPSS 0.16% · P6

Affected Version Matrix 2

VendorProduct Version RangeStatus
cookies cookies < 0.9.2 affected
0.9.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88038

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
Source: CVE Program / CVE List V5
Vulnerability Description
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cookies cookies 0 ~ 0.9.2 -

II. Public POCs for CVE-2026-88038

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88038

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-88038 (1)

IV. Related Vulnerabilities

Same weakness: CWE-74

V. Comments for CVE-2026-88038

No comments yet

Leave a comment