CVE-2024-47764
cookie accepts cookie name, path, and domain with out of bounds characters
CVE-2024-47764 is a medium vulnerability (CVSS 6.9) in Jshttp Cookie, published October 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in cookie 0.7.0.
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
cookie accepts cookie name, path, and domain with out of bounds characters
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
CVE-2024-47764- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2024-3106
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
EUVD-2024-3106- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxg6-pf52-xh8x No score
cookie accepts cookie name, path, and domain with out of bounds characters
Impact
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Patches
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Workarounds
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
References
- Record
GHSA-pxg6-pf52-xh8x- Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
CVE-2024-47764- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
cookie accepts cookie name, path, and domain with out of bounds characters
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
CVE-2024-47764- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-47764
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
DEBIAN-CVE-2024-47764- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 18 moreShow less
OSVUBUNTU-CVE-2024-47764
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
UBUNTU-CVE-2024-47764- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVAZL-50067 No score
CVE-2024-47764 affecting package nodejs-nodemon 2.0.3-5
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
AZL-50067- Updated
- 2026-11-02
OSVAZL-50073 No score
CVE-2024-47764 affecting package js-jquery 3.5.0-4
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
AZL-50073- Updated
- 2026-11-02
OSVAZL-50085 No score
CVE-2024-47764 affecting package js-jquery 3.5.0-4
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
AZL-50085- Updated
- 2026-11-02
OSVAZL-50094 No score
CVE-2024-47764 affecting package nodejs-nodemon 2.0.3-4
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
AZL-50094- Updated
- 2026-11-02
OSVAZL-50114 No score
CVE-2024-47764 affecting package reaper for versions less than 3.1.1-13
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Record
AZL-50114- Updated
- 2026-11-02
OSVCLSA-2026-1773879462 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.5.0-tuxcare.1.
- Record
CLSA-2026-1773879462- Updated
- 2026-11-02
OSVCLSA-2026-1773879464 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.0.5-tuxcare.1.
- Record
CLSA-2026-1773879464- Updated
- 2026-11-02
OSVCLSA-2026-1773879466 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.3.1-tuxcare.1.
- Record
CLSA-2026-1773879466- Updated
- 2026-11-02
OSVCLSA-2026-1773879467 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.1.3-tuxcare.1.
- Record
CLSA-2026-1773879467- Updated
- 2026-11-02
OSVCLSA-2026-1774052366 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.4.2-tuxcare.1.
- Record
CLSA-2026-1774052366- Updated
- 2026-11-02
OSVCLSA-2026-1777336757 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.7.2-tuxcare.1.
- Record
CLSA-2026-1777336757- Updated
- 2026-11-02
OSVCLSA-2026-1780447837 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.4.0-tuxcare.1.
- Record
CLSA-2026-1780447837- Updated
- 2026-11-02
OSVCLSA-2026-1780447838 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.6.0-tuxcare.1.
- Record
CLSA-2026-1780447838- Updated
- 2026-11-02
OSVCLSA-2026-1790965371 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.1.0-tuxcare.1.
- Record
CLSA-2026-1790965371- Updated
- 2026-11-02
OSVCLSA-2026-1792573061 No score
TuxCare security update for cookie (1 CVE)
TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.0.4-tuxcare.1.
- Record
CLSA-2026-1792573061- Updated
- 2026-11-02
OSVGHSA-pxg6-pf52-xh8x No score
cookie accepts cookie name, path, and domain with out of bounds characters
Impact
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Patches
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Workarounds
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
References
- Record
GHSA-pxg6-pf52-xh8x- Weakness
- CWE-74
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-47764 No score
CVE-2024-47764 in @rootio/cookie - Patched by Root
Root has patched CVE-2024-47764 in the @rootio/cookie package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-47764- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cookienpm |
before 0.7.0 | 0.7.0 |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
js-jqueryAzure Linux:2 |
through 3.5.0-4 | None known |
nodejs-nodemonAzure Linux:2 |
through 2.0.3-4 | None known |
reaperAzure Linux:2 |
before 3.1.1-13 | 3.1.1-13 |
cookieTuxCare:npm |
0.5.0-tuxcare.0 up to 0.5.0-tuxcare.1, plus listed versions 0.5.0 |
0.5.0-tuxcare.1 |
cookieTuxCare:npm |
0.0.5-tuxcare.0 up to 0.0.5-tuxcare.1, plus listed versions 0.0.5 |
0.0.5-tuxcare.1 |
cookieTuxCare:npm |
0.3.1-tuxcare.0 up to 0.3.1-tuxcare.1, plus listed versions 0.3.1 |
0.3.1-tuxcare.1 |
cookieTuxCare:npm |
0.1.3-tuxcare.0 up to 0.1.3-tuxcare.1, plus listed versions 0.1.3 |
0.1.3-tuxcare.1 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cookieTuxCare:npm |
0.4.2-tuxcare.0 up to 0.4.2-tuxcare.1, plus listed versions 0.4.2 |
0.4.2-tuxcare.1 |
cookieTuxCare:npm |
0.7.2-tuxcare.0 up to 0.7.2-tuxcare.1, plus listed versions 0.7.2 |
0.7.2-tuxcare.1 |
cookieTuxCare:npm |
0.4.0-tuxcare.0 up to 0.4.0-tuxcare.1, plus listed versions 0.4.0 |
0.4.0-tuxcare.1 |
cookieTuxCare:npm |
0.6.0-tuxcare.0 up to 0.6.0-tuxcare.1, plus listed versions 0.6.0 |
0.6.0-tuxcare.1 |
cookieTuxCare:npm |
0.1.0-tuxcare.0 up to 0.1.0-tuxcare.1, plus listed versions 0.1.0 |
0.1.0-tuxcare.1 |
cookieTuxCare:npm |
0.0.4-tuxcare.0 up to 0.0.4-tuxcare.1, plus listed versions 0.0.4 |
0.0.4-tuxcare.1 |
node-cookieDebian:12 |
All versions, plus listed versions 0.5.0-20.6.0+~0.6.0-10.6.0-10.7.1+~0.6.0-10.7.2+~0.6.0-1 |
None known |
node-cookieDebian:13 |
before 0.7.1+~0.6.0-1 | 0.7.1+~0.6.0-1 |
node-cookieDebian:14 |
before 0.7.1+~0.6.0-1 | 0.7.1+~0.6.0-1 |
@rootio/cookieRoot:npm |
before 0.4.2-root.io.1 | 0.4.2-root.io.1 |
cookieRoot:npm |
before 0.4.2-aikido.1 | 0.4.2-aikido.1 |
node-cookieUbuntu:16.04:LTS |
All versions, plus listed versions 0.1.2-2 |
None known |
node-cookieUbuntu:18.04:LTS |
All versions, plus listed versions 0.1.2-20.1.2-2ubuntu1 |
None known |
node-cookieUbuntu:20.04:LTS |
All versions, plus listed versions 0.3.1+20180326git4e2b255de6b85c3ec-10.4.0-1 |
None known |
node-cookieUbuntu:22.04:LTS |
All versions, plus listed versions 0.4.1-10.4.1-2 |
None known |
node-cookieUbuntu:24.04:LTS |
All versions, plus listed versions 0.5.0-2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x
nvd.nist.gov/vuln/detail/CVE-2024-47764