Description
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jshttp | cookie | < 0.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-cookie | 0.7.1+~0.6.0-1 | — |
| Debian 13 | node-cookie | 0.7.1+~0.6.0-1 | — |
| Debian 12 | node-cookie | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | node-cookie | No fix yet | — |
| Ubuntu 22.04 LTS | node-cookie | No fix yet | — |
| Ubuntu 20.04 LTS | node-cookie | No fix yet | — |
| Ubuntu 18.04 LTS | node-cookie | No fix yet | — |
| Ubuntu 16.04 LTS | node-cookie | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +1 | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | js-jquery +1 | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | reaper | 3.1.1-13 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows | 3.6.0-r1 | — |
| Wolfi rolling | jitsucom-jitsu +2 | 2.8.2-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.9.1-r1 | — |
| Wolfi rolling | kubeflow-pipelines +11 | 2.4.0-r9 | — |
| Wolfi rolling | sqlpad +1 | 7.5.2-r2 | — |
| Wolfi rolling | thingsboard +4 | 3.9.1-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | cookie | < 0.7.0 | 0.7.0 | GHSA-pxg6-pf52-xh8x |
Advisories 3
- WID-SEC-2025-0034 IBM App Connect Enterprise: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 13, 2026
- WID-SEC-2025-0705 HCL BigFix WebUI-Anwendungen: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 25, 2025
- WID-SEC-2025-0043 IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 17, 2025