Cookies is a Node.js library for reading and writing HTTP cookies. In versions earlier than 0.9.2 the library checks the cookie name and value for illegal characters, but it only applies a permissive field-content matcher to the domain and path options, which permits semicolons. These options are then written directly into the Set-Cookie header without escaping. If an application supplies untrusted or request-derived data to the domain or path parameters, an attacker can inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain settings on cookies the application issues. The flaw is a Set-Cookie attribute injection vulnerability (CWE‑74).

The impact is limited to applications that use the "cookies" library, including projects such as Koa that consume the library via ctx.cookies. Any deployment of cookies prior to version 0.9.2 is affected; upgrades to 0.9.2 or later include the fix. No other vendors or products are referenced in the advisory.

The vulnerability has a CVSS score of 4.8, indicating moderate risk. The EPSS score is not available, but the flaw is not listed in CISA’s KEV catalog, suggesting no currently known exploitation in the wild. However, because the flaw allows manipulation of cookie attributes, an attacker who can control the domain or path options could undermine cookie security, potentially facilitating session fixation or other credential theft attacks. An application that accepts user input for these options is the primary attack vector; thus, the risk is highest in scenarios where domain or path values are derived from request data or external inputs.