CVE-2026-88038
Description
A flaw was found in the cookies Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the Set-Cookie header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive, allowing semicolons which are then written unescaped. Successful exploitation could lead to the overriding of critical cookie security attributes like SameSite, Secure, HttpOnly, or Domain, potentially resulting in information disclosure or other integrity impacts.
Statement
Red Hat Product Security has determined that this issue affects Red Hat OpenShift, Red Hat OpenShift AI, Red Hat Ansible Automation Platform Portal, and Red Hat Developer Hub products that bundle the cookies Node.js library (versions prior to 0.9.2). The vulnerability allows Set-Cookie attribute injection when applications pass untrusted or request-derived data to the domain or path options. An attacker could exploit this to override cookie security attributes such as SameSite, Secure, HttpOnly, or Domain, potentially leading to session hijacking or cross-site attacks. Products are only vulnerable if they pass user-controlled input to these specific options; applications using only static, hardcoded domain and path values are not affected.
Mitigation
Update to cookies library version 0.9.2 or later. As a workaround, ensure that domain and path options for cookies are application-set constants rather than derived from untrusted input such as request headers or user-provided data. Review code that calls cookies.set() to verify that domain and path values are not influenced by external input.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
