Bug 2531413 (CVE-2026-88038)

Summary:	CVE-2026-88038 cookies: cookies: Set-Cookie attribute injection via unvalidated domain and path options
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, dpaolell, dschmidt, ikhan, jchui, jdelft, jhe, jlanda, jupierce, kshier, ktsao, lgarciaa, mbiarnes, nboldt, oaljalju, ppalepu, ppostler, prdhamdh, psrna, rbobbitt, sghai, sidsharm, simaishi, stcannon, suppawar, vlaad, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `cookies` Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the `Set-Cookie` header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive, allowing semicolons which are then written unescaped. Successful exploitation could lead to the overriding of critical cookie security attributes like `SameSite`, `Secure`, `HttpOnly`, or `Domain`, potentially resulting in information disclosure or other integrity impacts.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-10 12:32:34 UTC

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.