An open index of dependabot pull requests across open source projects.

cookie accepts cookie name, path, and domain with out of bounds characters

GHSA-pxg6-pf52-xh8x CVE-2024-47764
Description:

Impact

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.

A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.

Patches

Upgrade to 0.7.0, which updates the validation for name, path, and domain.

Workarounds

Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.

References

Affected Packages
Ecosystem Package Vulnerable Versions Patched Version
npm cookie < 0.7.0
0.7.0
Related Dependabot Pull Requests
Bump body-parser and express
Closed 1 day ago
amerorchis/RENXT_integration_FrontEnd #2
npm:express npm:body-parser
amerorchis
chore(deps): bump express and @types/express
Open 2 days ago
MihaelaAghirculesei/birthday-reminder-pro #84
npm:express npm:@types/express
MihaelaAghirculesei
Bump express from 4.22.3 to 5.2.1
Open 3 days ago
CoderRahul01/memoria #2
npm:express
CoderRahul01
chore(docs-mcp-deps): bump express and @types/express in /mcp/docs-mcp-server
Closed 4 days ago
elf-express/mcp-library #66
npm:express npm:@types/express
elf-express
chore(deps): bump express from 4.22.3 to 5.2.1
Open 4 days ago
txchiefcybernetics-lang/tradexpress-app #20
npm:express
txchiefcybernetics-lang
chore(deps): bump the other-dependencies group with 3 updates
Closed 4 days ago
boy-offi9-inc/btch-downloader-api #4
npm:express npm:dotenv +1 more
boy-offi9-inc
chore(deps): bump the production-dependencies group across 1 directory with 16 updates
Open 6 days ago
ashfaqizop/neobot #25
npm:react-router-dom npm:zod +14 more
ashfaqizop
chore(deps): bump the dependencias group across 1 directory with 12 updates
Closed 7 days ago
celiotibes/Lucide-react #18
npm:vitest npm:zod +10 more
celiotibes
⬆️(deps): Bump the npm-major group across 1 directory with 6 updates
Open 7 days ago
davidcanington18-ctrl/dashy #19
npm:vitest npm:@vitest/ui +4 more
davidcanington18-ctrl
Bump express from 4.22.3 to 5.2.1 in /api
Open 7 days ago
emmanueladejuwon2021-star/MenuCraft #8
npm:express
emmanueladejuwon2021-star
Bump express from 4.22.3 to 5.2.1
Closed 8 days ago
rakeshjhacs/juice-shop #29
npm:express
rakeshjhacs
Bump express from 4.22.3 to 5.2.1 in /portfolio-projects/blockchain-api-service/backend
Open 8 days ago
tommyshamamba/SONOFGOD. #19
npm:express
tommyshamamba
chore(deps): bump the major group across 1 directory with 20 updates
Closed 8 days ago
slimatic/zakapp #640
npm:vitest npm:@vitest/coverage-v8 +18 more
slimatic
build(deps): Bump the alle group across 1 directory with 18 updates
Closed 8 days ago
sundartha/hermes #190
npm:globals npm:zod +16 more
sundartha
Bump express from 4.18.2 to 4.22.3
Open 9 days ago
thefarmhousedesign/shopify-renewed #566
npm:express
thefarmhousedesign
[CAPITAL-AI-TRUST]: Bump express and @types/express
Open 9 days ago
SvenKulessa/Capital-AI #68
npm:@types/express npm:Bump express
SvenKulessa
Bump express from 4.22.3 to 5.2.1 in /app
Closed 9 days ago
zendev2112/pipeline-devops #5
npm:express
zendev2112
chore(deps): bump qs and express
Closed 10 days ago
luismgoyone/personal-website #5
npm:express npm:qs
luismgoyone
chore(deps): bump the production group across 1 directory with 9 updates
Open 11 days ago
wahidhendrawan/VulnBoard #90
npm:zod npm:puppeteer +7 more
wahidhendrawan
Bump express from 4.22.3 to 5.2.1 in /src/backend
Closed 11 days ago
IT7993-FALL-2026-PEERS/ProjectPeerEvaluation #74
npm:express
IT7993-FALL-2026-PEERS
chore(deps): bump express from 4.22.2 to 5.2.1 in /backend
Open 11 days ago
ritik4ever/stellar-goal-vault #1270
npm:express
ritik4ever
chore(deps): Bump the security-updates group across 1 directory with 19 updates
Closed 13 days ago
farfandavid/aicvanalizer #9
npm:@babel/helpers npm:cross-spawn +17 more
farfandavid
chore: bump express from 4.22.3 to 5.2.1 in /clients/typescript
Closed 13 days ago
dlresende/extreme-carpaccio #473
npm:express
dlresende
Bump the npm_and_yarn group across 1 directory with 29 updates
Closed 13 days ago
helderharada/courses2025ForMe #1
npm:@babel/runtime npm:cross-spawn +27 more
helderharada
build(deps): bump express and @types/express
Open 15 days ago
pruthvivadlamudi/crossborder-nonprofit-gateway #5
npm:express npm:@types/express
pruthvivadlamudi
chore(deps): bump the production-dependencies group across 1 directory with 12 updates
Closed 15 days ago
valcriss/rene-website #99
npm:express npm:@prisma/client +10 more
valcriss
chore(deps): bump express from 4.22.2 to 5.2.1 in /whatsapp
Closed 15 days ago
LuckyTriple7/HA-AddOns #323
npm:express
LuckyTriple7
chore(deps): bump express from 4.20.0 to 5.2.1
Open 15 days ago
stefanwalther/docker-test #148
npm:express
stefanwalther
Bump express from 4.22.3 to 5.2.1
Closed 18 days ago
chris-kretschmer/snar #8
npm:express
chris-kretschmer
Bump the backend-dependencies group in /backend with 21 updates
Open 18 days ago
GeorgeSamuel15/hospital-record #2
npm:zod npm:eslint +19 more
GeorgeSamuel15
deps(deps): bump the major group with 56 updates
Closed 18 days ago
SriKaratalapu/juice-shop-krishna #121
npm:eslint npm:@types/node +54 more
SriKaratalapu
chore(deps): bump express from 4.22.3 to 5.2.1 in /examples/mcp-server
Open 19 days ago
askable-ui/askable #482
npm:express
askable-ui
chore(deps): bump the production-dependencies group with 8 updates
Closed 19 days ago
CYONCHAT/clinical #6
npm:zod npm:express +6 more
CYONCHAT
chore(deps): bump express and @types/express in /backend
Open 21 days ago
gonzalo0909/lapa-casa-rio #74
npm:express npm:@types/express
gonzalo0909
Bump express from 4.21.2 to 5.2.1
Open 21 days ago
Mario3sid/interstellar #2
npm:express
Mario3sid
Bump express and @types/express
Open 21 days ago
Leo88q/caps #17
npm:express npm:@types/express
Leo88q
Bump qs, express, jest and jest-puppeteer
Closed 21 days ago
VirtualFlyBrain/geppetto-vfb #1783
npm:jest-puppeteer npm:qs, express, jest
VirtualFlyBrain
Bump express from 4.22.3 to 5.2.1
Closed 22 days ago
VincentJerico/taskflow-under-test #2
npm:express
VincentJerico
build(deps): bump express and @types/express in /packages/mcp
Closed 22 days ago
souzalrns/network-agents-setup #18
npm:express npm:@types/express
souzalrns
Bump qs and express in /quarkus-workshop-super-heroes/super-heroes/ui-super-heroes/src/main/webui
Open 24 days ago
quarkusio/quarkus-workshops #784
npm:express npm:qs
quarkusio
Bump express from 4.22.3 to 5.2.1
Open 24 days ago
DeviceFarmer/stf #994
npm:express
DeviceFarmer
chore(deps): bump express from 4.22.2 to 5.2.1 in /e-wallet-backend
Open 24 days ago
Michaelo7710/e-wallet-monorepo #7
npm:express
Michaelo7710
Bump express and @types/express
Open 24 days ago
LucasFelipeMartins/GestoFinance #5
npm:express npm:@types/express
LucasFelipeMartins
chore(deps): bump the npm-deps group with 2 updates
Open 24 days ago
yourdudeken/daraja #24
npm:express npm:@types/express
yourdudeken
chore(deps): bump express from 4.22.2 to 5.2.1
Open 24 days ago
Antoniodeoliveirasegura/boilerindy #269
npm:express
Antoniodeoliveirasegura
Bump the npm_and_yarn group across 1 directory with 22 updates
Open 24 days ago
alphaleadership/social-analyzer #65
npm:ws npm:nanoid +14 more
alphaleadership
Bump the npm_and_yarn group across 1 directory with 10 updates
Open 24 days ago
alphaleadership/discord-fs-1 #1
npm:undici npm:ws +8 more
alphaleadership
Bump the npm_and_yarn group across 1 directory with 14 updates
Closed 24 days ago
alphaleadership/simple-discordjs-dashboard #13
npm:ws npm:express +6 more
alphaleadership
Bump the npm_and_yarn group across 1 directory with 7 updates
Open 24 days ago
alphaleadership/hiter #1
npm:express npm:serve-static +5 more
alphaleadership
chore(deps): bump express and @types/express
Open 24 days ago
RemyLoveLogicAI/mcp-games-monorepo #68
npm:express npm:@types/express
RemyLoveLogicAI
Advisory Details
Published: October 04, 2024 about 2 years ago
Updated: September 10, 2026 30 days ago
EPSS: 0.74% 53th percentile
Source: Github
Classification: GENERAL
UUID: GSA_kwCzR0hTQS1weGc2LXBmNTIteGg4eM4AA_9q
PR Statistics
PR Status
Open 9253 (51.8%)
Merged 1777 (9.9%)
Closed 6846 (38.3%)
Update Types
Major 12441 (20.4%)
Minor 30268 (49.5%)
Patch 16447 (26.9%)