cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options

CVE-2026-88038 affects the npm cookies package (pillarjs/cookies) in all versions before 0.9.2. The library constructs Set-Cookie response headers by concatenating domain and path option values directly into the header string. While cookie *names* and *values* are validated against character sets that reject semicolons, the domain and path parameters only pass through permissive RFC 7230 validation that allows semicolons. An attacker who can influence the value passed to domain or path — for example via domain: '.' + req.headers.host — can inject additional cookie attributes (SameSite, Secure, HttpOnly, Domain) into the response header. The package has ~1.9 million weekly npm downloads and is a core dependency of the Koa framework and various Express middleware stacks.

The vendor's MEDIUM 4.8 score is honest but arguably still generous. The CVSS vector correctly sets AC:H because exploitation requires the application to pass *untrusted, request-derived input* into the domain or path cookie options — a pattern most production codebases simply don't use. Developers overwhelmingly hardcode these values or pull them from server-side configuration. Even when the chain succeeds, the impact ceiling is limited to weakening cookie security flags (stripping HttpOnly, overriding SameSite), which is a *precondition* for further attacks like CSRF or session fixation — not a direct compromise. There is no RCE, no authentication bypass, and no availability impact. noisgate downgrades to LOW 3.5.

Why this verdict

• Attack complexity is genuinely high (AC:H is accurate): The vulnerability is only reachable when the consuming application passes untrusted, request-derived input into cookie domain or path options. This is a specific anti-pattern, not a default behavior of the library or its framework consumers (Koa, egg.js).
• Impact ceiling is a stepping stone, not a destination: Successful injection weakens cookie attributes (SameSite, HttpOnly, Secure) but does not directly yield credential theft, RCE, or data exfiltration. A second, independent vulnerability must be chained for meaningful impact. The CVSS C:L/I:L/A:N accurately reflects this.
• Reverse-proxy friction eliminates most real-world paths: Production Node.js deployments almost universally sit behind nginx, Cloudflare, AWS ALB, or similar reverse proxies that normalize or reject malformed Host headers containing semicolons, cutting off the primary injection vector before it reaches application code.
• Role multiplier: pillarjs/cookies is a web-application-tier library. In high-value roles (IdP built on Koa, CI/CD dashboard), the chain could weaken session cookie protections — but the outcome is still 'weakened cookie flags requiring a chained attack,' not 'domain takeover / fleet compromise / mass data egress.' The blast radius is tenant-scoped at most and conditional on a second vuln. Floor does not trigger.
• No exploitation evidence or tooling: Zero in-the-wild activity, no public PoC, no KEV listing, advisory published today. The absence of any attacker interest further supports a lower severity.

Why not higher?

A MEDIUM rating would require either a realistic path to direct compromise without chaining or evidence that the vulnerable coding pattern is common in production. Neither condition is met. The AC:H constraint is not theoretical — it requires a specific, uncommon application anti-pattern. Even the 1.9M weekly downloads represent *library* adoption, not *vulnerable-pattern* adoption; the actual exploitable population is a small fraction of that base.

Why not lower?

An IGNORE rating would be inappropriate because the library is extremely widely deployed and a non-trivial number of applications *could* exhibit the vulnerable pattern, especially multi-tenant SaaS platforms that dynamically scope cookies to tenant-supplied domains. The fix is a single npm update and the risk, while low, is non-zero. Tracking and patching within a backlog cycle is warranted.

1. Audit application code for untrusted input flowing into cookie options — Search your codebase for calls to cookies.set() or Koa's ctx.cookies.set() where the domain or path option is derived from req.headers, query parameters, or any user-controlled source. If no such pattern exists, your application is not exploitable regardless of library version. This is a one-time audit — no ongoing SLA since verdict is LOW.
2. Ensure reverse proxy normalizes Host headers — Verify that your upstream reverse proxy (nginx, Cloudflare, ALB, Envoy) rejects or strips semicolons, carriage returns, and newlines from the Host header before forwarding to Node.js. This blocks the primary injection vector at the network edge.
3. Upgrade to cookies 0.9.2 — Run npm update cookies or pin >=0.9.2 in package.json. This is the definitive fix — the new version rejects semicolons, CR, and LF in domain and path options. Per the LOW verdict, treat this as backlog hygiene with no hard SLA.

Run this on any machine with Node.js and npm/npx available. It checks the installed version of the cookies package in the current project directory. No special privileges required. Example: bash check_cve_2026_88038.sh /path/to/your/node/project

#!/usr/bin/env bash
# check_cve_2026_88038.sh — Detect CVE-2026-88038 in pillarjs/cookies
# Usage: bash check_cve_2026_88038.sh [project_dir]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"
PKG_JSON="$PROJECT_DIR/node_modules/cookies/package.json"

if [ ! -f "$PKG_JSON" ]; then
  echo "UNKNOWN — cookies package not found in $PROJECT_DIR/node_modules/"
  exit 2
fi

VERSION=$(node -e "console.log(require('$PKG_JSON').version)" 2>/dev/null)
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse version from $PKG_JSON"
  exit 2
fi

# Compare version against fixed version 0.9.2
RESULT=$(node -e "
  const v = '$VERSION'.split('.').map(Number);
  const fix = [0, 9, 2];
  for (let i = 0; i < 3; i++) {
    if ((v[i]||0) < fix[i]) { console.log('VULNERABLE'); process.exit(0); }
    if ((v[i]||0) > fix[i]) { console.log('PATCHED'); process.exit(0); }
  }
  console.log('PATCHED');
")

echo "$RESULT — cookies version $VERSION (fixed in 0.9.2)"
if [ "$RESULT" = "VULNERABLE" ]; then
  exit 1
elif [ "$RESULT" = "PATCHED" ]; then
  exit 0
else
  exit 2
fi

Sources

1. GitHub Advisory GHSA-x44v-5gxf-r6hf
2. pillarjs/cookies GitHub repository
3. npm cookies package
4. Related: Hono cookie injection CVE-2026-29086
5. Related: undici cookie injection CVE-2026-16729
6. CISA KEV Catalog
7. CWE-74: Improper Neutralization of Special Elements