Zelys-Dfkh

The `makeCookie()` function allows semicolon delimiters in the `name`, `domain`, and `path` fields, which the `serializeCookie()` function then writes verbatim into Set-Cookie headers. If an attacker can control these values, they may append cookie attributes such as a broader `Domain`, `SameSite=None`, or `Max-Age`. This can result in widening the scope of a cookie or adding attributes that were not originally intended.

The library fails to properly validate the `domain` and `path` options, checking them against a permissive RFC 7230 field-content matcher that allows semicolons. Because these values are written into the Set-Cookie header unescaped, an application passing untrusted or request-derived data into these options allows for Set-Cookie attribute injection. This can enable an attacker to override attributes such as `SameSite`, `Secure`, `HttpOnly`, or `Domain` on issued cookies.

The `setCookie()` function fails to fully sanitize cookie attributes. Specifically, the domain value is not checked for semicolons and entries in the unparsed array are not sanitized. This allows attacker-influenced input to inject additional cookie attributes. For instance, a domain value containing a semicolon can append attributes like `SameSite`, and an unparsed entry can inject attributes such as `HttpOnly` without the caller's intent. Applications passing user-controlled input to these fields, such as reverse-proxy or multi-tenant servers scoping session cookies to tenant-supplied domains, may experience bypassed SameSite CSRF protections or have the `Secure`, `HttpOnly`, and `SameSite` attributes forced, stripped, or overridden.