Medium, CVSS 6.3npmAmendedPublished
Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
CVE-2026-115779 · GHSA-chp3-j5qr-2vfr
- Affected
- npm @effect/platform >= 0.1.0, < 0.97.1
- Fixed in
- 0.97.1· Vendor fix available
- Issue
- Impact The `name`, `domain`, and `path` fields of `makeCookie()` were validated with a regex that allows `;`, the attribute separator in `Set-Cookie` headers. Because `serializeCookie()` writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header. For example, a `domain` of `"legit.com; Domain=.parent.tld"` serializes to `session=token; Domain=legit.com; Domain=.parent.tld`. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets `SameSite=None` or `Max-Age` when the caller has not set those options itself. The `value` field is unaffected: it passes through `encodeURIComponent`, which encodes `;`. CR and LF are rejected by the existing regex, so header splitting is not possible. Patches Fixed in #6763 (v4) and #6765 (v3): the shared regex is split into per-field validators that reject `;`, and `serializeCookie()` now validates…
Recommended action: Upgrade to 0.97.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.