CVE-2026-88038

Name of the Vulnerable Software and Affected Versions cookies versions prior to 0.9.2

Description The library fails to properly validate the domain and path options, checking them against a permissive RFC 7230 field-content matcher that allows semicolons. Because these values are written into the Set-Cookie header unescaped, an application passing untrusted or request-derived data into these options allows for Set-Cookie attribute injection. This can enable an attacker to override attributes such as SameSite, Secure, HttpOnly, or Domain on issued cookies.

Recommendations Update to version 0.9.2. Keep domain and path application-set rather than derived from untrusted input.