{"id":"CVE-2024-47764","aliases":["AZL-50067","AZL-50073","AZL-50085","AZL-50094","AZL-50114","CLSA-2026-1773879462","CLSA-2026-1773879464","CLSA-2026-1773879466","CLSA-2026-1773879467","CLSA-2026-1774052366","CLSA-2026-1777336757","CLSA-2026-1780447837","CLSA-2026-1780447838","CLSA-2026-1790965371","CLSA-2026-1792573061","DEBIAN-CVE-2024-47764","EUVD-2024-3106","GHSA-pxg6-pf52-xh8x","ROOT-APP-NPM-CVE-2024-47764","UBUNTU-CVE-2024-47764"],"status":"published","title":"cookie accepts cookie name, path, and domain with out of bounds characters","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00744,"percentile":0.55205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2024-10-04T19:09:46Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"cookie","fixed_in":["0.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-13"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"cookie","fixed_in":["0.5.0-tuxcare.1","0.0.5-tuxcare.1","0.3.1-tuxcare.1","0.1.3-tuxcare.1","0.4.2-tuxcare.1","0.7.2-tuxcare.1","0.4.0-tuxcare.1","0.6.0-tuxcare.1","0.1.0-tuxcare.1","0.0.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-cookie","fixed_in":["0.7.1+~0.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-cookie","fixed_in":["0.7.1+~0.6.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/cookie","fixed_in":["0.4.2-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"cookie","fixed_in":["0.4.2-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0-tuxcare.0"},{"fixed":"0.5.0-tuxcare.1"}]}],"versions":["0.5.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.5-tuxcare.0"},{"fixed":"0.0.5-tuxcare.1"}]}],"versions":["0.0.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.1-tuxcare.0"},{"fixed":"0.3.1-tuxcare.1"}]}],"versions":["0.3.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.3-tuxcare.0"},{"fixed":"0.1.3-tuxcare.1"}]}],"versions":["0.1.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2-tuxcare.0"},{"fixed":"0.4.2-tuxcare.1"}]}],"versions":["0.4.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.2-tuxcare.0"},{"fixed":"0.7.2-tuxcare.1"}]}],"versions":["0.7.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0-tuxcare.0"},{"fixed":"0.4.0-tuxcare.1"}]}],"versions":["0.4.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0-tuxcare.0"},{"fixed":"0.6.0-tuxcare.1"}]}],"versions":["0.6.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-tuxcare.0"},{"fixed":"0.1.0-tuxcare.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.4-tuxcare.0"},{"fixed":"0.0.4-tuxcare.1"}]}],"versions":["0.0.4"]},{"source":"osv","ecosystem":"Debian:12","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.0-2","0.6.0+~0.6.0-1","0.6.0-1","0.7.1+~0.6.0-1","0.7.2+~0.6.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1+~0.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1+~0.6.0-1"}]}]},{"source":"osv","ecosystem":"npm","package":"cookie","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.2-2","0.1.2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.1+20180326git4e2b255de6b85c3ec-1","0.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1-1","0.4.1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.0-2"]}],"products":[{"vendor":"jshttp","product":"cookie"}],"references":[{"url":"https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/jshttp/cookie/pull/167","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47764.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-47764","tags":["advisory"]},{"url":"https://github.com/jshttp/cookie","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-47764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47764","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-47764","title":"cookie accepts cookie name, path, and domain with out of bounds characters","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T19:09:46.64Z","modified":"2024-10-04T20:14:56.059Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:33:57.302325Z"}],"euvd":[{"id":"EUVD-2024-3106","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T19:09:46Z","modified":"2024-10-04T20:14:56Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T00:27:49.014643Z"}],"ghsa":[{"id":"GHSA-pxg6-pf52-xh8x","title":"cookie accepts cookie name, path, and domain with out of bounds characters","description":"### Impact\n\nThe cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize(\"userName=\u003cscript\u003ealert('XSS3')\u003c/script\u003e; Max-Age=2592000; a\", value)` would result in `\"userName=\u003cscript\u003ealert('XSS3')\u003c/script\u003e; Max-Age=2592000; a=test\"`, setting `userName` cookie to `\u003cscript\u003e` and ignoring `value`.\n\nA similar escape can be used for `path` and `domain`, which could be abused to alter other fields of the cookie.\n\n### Patches\n\nUpgrade to 0.7.0, which updates the validation for `name`, `path`, and `domain`.\n\n### Workarounds\n\nAvoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.\n\n### References\n\n* https://github.com/jshttp/cookie/pull/167","status":"published","published":"2024-10-04T20:31:00Z","modified":"2025-04-15T13:56:44Z","cwes":["CWE-74"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2024-47764","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:07.31Z","modified":"2026-06-17T07:57:42.753Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:10:30.673028Z"}],"osv":[{"id":"CVE-2024-47764","title":"cookie accepts cookie name, path, and domain with out of bounds characters","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T19:09:46.64Z","modified":"2026-10-28T02:31:12.837826301Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"DEBIAN-CVE-2024-47764","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:07.31Z","modified":"2026-11-02T12:02:52.810086361Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"UBUNTU-CVE-2024-47764","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:00Z","modified":"2025-10-24T05:13:13Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"AZL-50067","title":"CVE-2024-47764 affecting package nodejs-nodemon 2.0.3-5","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:07Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"AZL-50073","title":"CVE-2024-47764 affecting package js-jquery 3.5.0-4","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:07Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"AZL-50085","title":"CVE-2024-47764 affecting package js-jquery 3.5.0-4","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:07Z","modified":"2026-04-21T04:30:06.543344Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-50094","title":"CVE-2024-47764 affecting package nodejs-nodemon 2.0.3-4","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:07Z","modified":"2026-04-21T04:30:07.298357Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-50114","title":"CVE-2024-47764 affecting package reaper for versions less than 3.1.1-13","description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","status":"published","published":"2024-10-04T20:15:07Z","modified":"2026-04-21T04:30:08.024099Z","updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"CLSA-2026-1773879462","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.5.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.812880631Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879464","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.0.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.004631812Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879466","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.193556619Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773879467","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.1.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.164379989Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774052366","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:02.090527332Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1777336757","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.7.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:47:07.68520129Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1780447837","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.4.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:48:03.654251572Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780447838","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.6.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:48:03.643750114Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1790965371","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.1.0-tuxcare.1.","status":"published","published":"2026-10-02T18:22:51Z","modified":"2026-10-15T09:47:58.024960645Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792573061","title":"TuxCare security update for cookie (1 CVE)","description":"TuxCare rebuilt cookie to address 1 CVE. Fixed in 0.0.4-tuxcare.1.","status":"published","published":"2026-10-21T08:57:41Z","modified":"2026-10-21T14:00:21.017411292Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"GHSA-pxg6-pf52-xh8x","title":"cookie accepts cookie name, path, and domain with out of bounds characters","description":"### Impact\n\nThe cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize(\"userName=\u003cscript\u003ealert('XSS3')\u003c/script\u003e; Max-Age=2592000; a\", value)` would result in `\"userName=\u003cscript\u003ealert('XSS3')\u003c/script\u003e; Max-Age=2592000; a=test\"`, setting `userName` cookie to `\u003cscript\u003e` and ignoring `value`.\n\nA similar escape can be used for `path` and `domain`, which could be abused to alter other fields of the cookie.\n\n### Patches\n\nUpgrade to 0.7.0, which updates the validation for `name`, `path`, and `domain`.\n\n### Workarounds\n\nAvoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.\n\n### References\n\n* https://github.com/jshttp/cookie/pull/167","status":"published","published":"2024-10-04T20:31:00Z","modified":"2026-09-10T03:50:19.898971417Z","cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"ROOT-APP-NPM-CVE-2024-47764","title":"CVE-2024-47764 in @rootio/cookie - Patched by Root","description":"Root has patched CVE-2024-47764 in the @rootio/cookie package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-24T07:59:09Z","modified":"2026-06-24T14:04:22.031329594Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}