cookie accepts cookie name, path, and domain with out of bounds characters
RSS Feed
LOW
GHSA-pxg6-pf52-xh8x
CVE-2024-47764
Description:
Impact
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Patches
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Workarounds
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
References
Affected Packages
| Ecosystem | Package | Vulnerable Versions | Patched Version |
|---|---|---|---|
| npm |
cookie
|
< 0.7.0 |
0.7.0
|
Bump body-parser and express
Closed 1 day ago
amerorchis/RENXT_integration_FrontEnd #2
npm:express
npm:body-parser
chore(deps): bump express and @types/express
Open 2 days ago
MihaelaAghirculesei/birthday-reminder-pro #84
npm:express
npm:@types/express
Bump express from 4.22.3 to 5.2.1
Open 3 days ago
CoderRahul01/memoria #2
npm:express
chore(docs-mcp-deps): bump express and @types/express in /mcp/docs-mcp-server
Closed 4 days ago
elf-express/mcp-library #66
npm:express
npm:@types/express
chore(deps): bump express from 4.22.3 to 5.2.1
Open 4 days ago
txchiefcybernetics-lang/tradexpress-app #20
npm:express
chore(deps): bump the other-dependencies group with 3 updates
Closed 4 days ago
boy-offi9-inc/btch-downloader-api #4
npm:express
npm:dotenv
+1 more
chore(deps): bump the production-dependencies group across 1 directory with 16 updates
Open 6 days ago
ashfaqizop/neobot #25
npm:react-router-dom
npm:zod
+14 more
chore(deps): bump the dependencias group across 1 directory with 12 updates
Closed 7 days ago
celiotibes/Lucide-react #18
npm:vitest
npm:zod
+10 more
⬆️(deps): Bump the npm-major group across 1 directory with 6 updates
Open 7 days ago
davidcanington18-ctrl/dashy #19
npm:vitest
npm:@vitest/ui
+4 more
Bump express from 4.22.3 to 5.2.1 in /api
Open 7 days ago
emmanueladejuwon2021-star/MenuCraft #8
npm:express
Bump express from 4.22.3 to 5.2.1
Closed 8 days ago
rakeshjhacs/juice-shop #29
npm:express
Bump express from 4.22.3 to 5.2.1 in /portfolio-projects/blockchain-api-service/backend
Open 8 days ago
tommyshamamba/SONOFGOD. #19
npm:express
chore(deps): bump the major group across 1 directory with 20 updates
Closed 8 days ago
slimatic/zakapp #640
npm:vitest
npm:@vitest/coverage-v8
+18 more
build(deps): Bump the alle group across 1 directory with 18 updates
Closed 8 days ago
sundartha/hermes #190
npm:globals
npm:zod
+16 more
Bump express from 4.18.2 to 4.22.3
Open 9 days ago
thefarmhousedesign/shopify-renewed #566
npm:express
[CAPITAL-AI-TRUST]: Bump express and @types/express
Open 9 days ago
SvenKulessa/Capital-AI #68
npm:@types/express
npm:Bump express
Bump express from 4.22.3 to 5.2.1 in /app
Closed 9 days ago
zendev2112/pipeline-devops #5
npm:express
chore(deps): bump qs and express
Closed 10 days ago
luismgoyone/personal-website #5
npm:express
npm:qs
chore(deps): bump the production group across 1 directory with 9 updates
Open 11 days ago
wahidhendrawan/VulnBoard #90
npm:zod
npm:puppeteer
+7 more
Bump express from 4.22.3 to 5.2.1 in /src/backend
Closed 11 days ago
IT7993-FALL-2026-PEERS/ProjectPeerEvaluation #74
npm:express
chore(deps): bump express from 4.22.2 to 5.2.1 in /backend
Open 11 days ago
ritik4ever/stellar-goal-vault #1270
npm:express
chore(deps): Bump the security-updates group across 1 directory with 19 updates
Closed 13 days ago
farfandavid/aicvanalizer #9
npm:@babel/helpers
npm:cross-spawn
+17 more
chore: bump express from 4.22.3 to 5.2.1 in /clients/typescript
Closed 13 days ago
dlresende/extreme-carpaccio #473
npm:express
Bump the npm_and_yarn group across 1 directory with 29 updates
Closed 13 days ago
helderharada/courses2025ForMe #1
npm:@babel/runtime
npm:cross-spawn
+27 more
build(deps): bump express and @types/express
Open 15 days ago
pruthvivadlamudi/crossborder-nonprofit-gateway #5
npm:express
npm:@types/express
chore(deps): bump the production-dependencies group across 1 directory with 12 updates
Closed 15 days ago
valcriss/rene-website #99
npm:express
npm:@prisma/client
+10 more
chore(deps): bump express from 4.22.2 to 5.2.1 in /whatsapp
Closed 15 days ago
LuckyTriple7/HA-AddOns #323
npm:express
chore(deps): bump express from 4.20.0 to 5.2.1
Open 15 days ago
stefanwalther/docker-test #148
npm:express
Bump express from 4.22.3 to 5.2.1
Closed 18 days ago
chris-kretschmer/snar #8
npm:express
Bump the backend-dependencies group in /backend with 21 updates
Open 18 days ago
GeorgeSamuel15/hospital-record #2
npm:zod
npm:eslint
+19 more
deps(deps): bump the major group with 56 updates
Closed 18 days ago
SriKaratalapu/juice-shop-krishna #121
npm:eslint
npm:@types/node
+54 more
chore(deps): bump express from 4.22.3 to 5.2.1 in /examples/mcp-server
Open 19 days ago
askable-ui/askable #482
npm:express
chore(deps): bump the production-dependencies group with 8 updates
Closed 19 days ago
CYONCHAT/clinical #6
npm:zod
npm:express
+6 more
chore(deps): bump express and @types/express in /backend
Open 21 days ago
gonzalo0909/lapa-casa-rio #74
npm:express
npm:@types/express
Bump express from 4.21.2 to 5.2.1
Open 21 days ago
Mario3sid/interstellar #2
npm:express
Bump express and @types/express
Open 21 days ago
Leo88q/caps #17
npm:express
npm:@types/express
Bump qs, express, jest and jest-puppeteer
Closed 21 days ago
VirtualFlyBrain/geppetto-vfb #1783
npm:jest-puppeteer
npm:qs, express, jest
Bump express from 4.22.3 to 5.2.1
Closed 22 days ago
VincentJerico/taskflow-under-test #2
npm:express
build(deps): bump express and @types/express in /packages/mcp
Closed 22 days ago
souzalrns/network-agents-setup #18
npm:express
npm:@types/express
Bump qs and express in /quarkus-workshop-super-heroes/super-heroes/ui-super-heroes/src/main/webui
Open 24 days ago
quarkusio/quarkus-workshops #784
npm:express
npm:qs
Bump express from 4.22.3 to 5.2.1
Open 24 days ago
DeviceFarmer/stf #994
npm:express
chore(deps): bump express from 4.22.2 to 5.2.1 in /e-wallet-backend
Open 24 days ago
Michaelo7710/e-wallet-monorepo #7
npm:express
Bump express and @types/express
Open 24 days ago
LucasFelipeMartins/GestoFinance #5
npm:express
npm:@types/express
chore(deps): bump the npm-deps group with 2 updates
Open 24 days ago
yourdudeken/daraja #24
npm:express
npm:@types/express
chore(deps): bump express from 4.22.2 to 5.2.1
Open 24 days ago
Antoniodeoliveirasegura/boilerindy #269
npm:express
Bump the npm_and_yarn group across 1 directory with 22 updates
Open 24 days ago
alphaleadership/social-analyzer #65
npm:ws
npm:nanoid
+14 more
Bump the npm_and_yarn group across 1 directory with 10 updates
Open 24 days ago
alphaleadership/discord-fs-1 #1
npm:undici
npm:ws
+8 more
Bump the npm_and_yarn group across 1 directory with 14 updates
Closed 24 days ago
alphaleadership/simple-discordjs-dashboard #13
npm:ws
npm:express
+6 more
Bump the npm_and_yarn group across 1 directory with 7 updates
Open 24 days ago
alphaleadership/hiter #1
npm:express
npm:serve-static
+5 more
chore(deps): bump express and @types/express
Open 24 days ago
RemyLoveLogicAI/mcp-games-monorepo #68
npm:express
npm:@types/express
Actions
Advisory Details
| Published: | October 04, 2024 about 2 years ago |
| Updated: | September 10, 2026 30 days ago |
| EPSS: | 0.74% 53th percentile |
| Source: | Github |
| Classification: | GENERAL |
| UUID: | GSA_kwCzR0hTQS1weGc2LXBmNTIteGg4eM4AA_9q |
PR Statistics
PR Status
Open
9253 (51.8%)
Merged
1777 (9.9%)
Closed
6846 (38.3%)
Update Types
Major
12441 (20.4%)
Minor
30268 (49.5%)
Patch
16447 (26.9%)