CVE-2026-88038

Executive Summary

CVE-2026-88038 is a Set-Cookie attribute injection vulnerability (CWE-74) in the cookies Node.js library, used by Koa through ctx.cookies. Prior to version 0.9.2, the library validated cookie name and value against character sets that reject the semicolon separator, but checked the domain and path options only against a permissive RFC 7230 field-content matcher that allows semicolons. Because both the domain and path values are written into the Set-Cookie header unescaped, an application that passes untrusted or request-derived data into either option can have additional cookie attributes injected into its own Set-Cookie output. Successful exploitation allows an attacker to override protective cookie attributes such as SameSite, Secure, HttpOnly, or Domain on cookies the application issues, enabling session-degradation, cookie-scope widening, and weakening of CSRF/XSS defenses. The CVSS 3.1 base score is 4.8 (Medium), reflecting network reachability but a high attack complexity and limited, non-session-hijacking impact.

Technical Analysis

The cookies library is a small Node.js utility for reading and writing HTTP cookies, and it is notably surfaced by the Koa web framework via the ctx.cookies interface. The vulnerability is a classic injection problem: a field that is intended to be a constrained protocol token (a cookie attribute value) is instead validated against a far more permissive grammar and then emitted without escaping into a structured header.

The core defect, per the NVD description:

• Cookie name and value are validated against strict character sets that reject the semicolon separator. This is correct behavior, because the semicolon is the delimiter that separates cookie pairs and their attributes inside a Set-Cookie header.
• The domain and path options are validated only against a permissive RFC 7230 field-content matcher that allows semicolons. RFC 7230 field-content is a generic HTTP header field-value grammar; it is not a cookie-specific grammar and does not prohibit the characters that are meaningful to Set-Cookie parsing.
• domain and path are written into the Set-Cookie header unescaped.

The combination of these three facts means that if an application derives domain or path from untrusted or request-derived input, that input flows into a header position where a semicolon is a structural delimiter rather than inert data. An attacker who can influence that value can therefore terminate the legitimate attribute list early and append additional attributes — the "attribute injection" for which this CVE is named.

Chromium and other user agents parse Set-Cookie positionally and permissively, so appended attributes like SameSite=None, removal of Secure/HttpOnly, or a different Domain can be honored by the browser. The result is that the application's own cookie can be downgraded or re-scoped without the application intending it.

The vulnerable class is CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') — specifically, header/attribute injection into an HTTP response. This is not a remote code execution issue, nor is it a credential-capture issue by itself; it is a response-integrity and cookie-security issue.

Attack surface: any application built on the affected library that forwards user-controlled or externally derived data into the domain or path options when setting a cookie. Because the flaw lives in a widely reused library, the blast radius is the dependency tree rather than a single product.

The cookies project at version 0.9.2 is described as validating domain and path against RFC 6265 character sets, which is the correct, cookie-specific grammar and which excludes the semicolon. That is the described fix path.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template is available for CVE-2026-88038 as of this report. The chain below is inferred strictly from the vulnerability class and the NVD description; no specific function names, endpoints, or parameters beyond those in the NVD description (domain, path, Set-Cookie, ctx.cookies) are asserted.

1. Reconnaissance / target identification. The attacker identifies a web application that uses the cookies library (commonly via Koa's ctx.cookies) and that reflects a request-derived value into the domain or path cookie option. Typical fingerprints include Koa-style headers and applications whose cookie scope tracks the request host or a query/path-derived routing value.

2. Triggering the flaw class. The attacker supplies input that the application places into the domain or path option. Because the library accepts semicolons in these fields (RFC 7230 field-content matcher), a semicolon in the supplied value is not neutralized before the value is concatenated into Set-Cookie.

3. Payload/execution method (class level). The attacker's input injects a ; delimiter followed by additional cookie attributes. At the vulnerability-class level, this is HTTP response header / Set-Cookie attribute injection: the attacker supplies domain/path content that terminates the legitimate attribute and appends attributes such as SameSite, Secure, HttpOnly, or Domain. The exact byte-level payload is browser- and application-dependent and is not specified in the advisory.

4. Post-exploitation impact. The application issues a cookie with attacker-influenced attributes. The attacker gains the ability to:

   • Weaken HttpOnly — making a session cookie readable by client-side script and thus exposed to XSS-driven theft.
   • Weaken Secure — allowing the cookie to be transmitted over cleartext HTTP and potentially intercepted.
   • Alter SameSite — relaxing cross-site protections, which can facilitate CSRF or cross-site request behavior.
   • Widen Domain — broadening cookie scope beyond the intended host so that the cookie is sent to sibling or attacker-relevant subdomains.

   This is a defense-degradation / scope-widening primitive, not direct code execution. Its practical severity depends entirely on what the affected application does with the cookie and what other flaws are present (e.g., XSS, CSRF, or subdomain takeover).

Impact Assessment

CVSS 3.1 base score 4.8 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.

• AV:N (Network) — reachable over the network; the attacker interacts with a web application.
• AC:H (High attack complexity) — exploitation is not unconditional. It requires the application to route untrusted or request-derived data into the domain or path cookie option, which is a non-default, application-specific anti-pattern. This high complexity is the main reason the score stays in the Medium band.
• PR:N / UI:N — no authentication or user interaction is strictly required by the vulnerability itself.
• S:U (Unchanged) — the impact stays within the authority of the vulnerable component.
• C:L / I:L (Low confidentiality / Low integrity) — consistency with the advisory: attributes on the application's own cookies can be overridden, degrading confidentiality (e.g., non-HttpOnly cookies exposed to script) and integrity (e.g., forged/loosened cookie scope), but not to a comprehensive breach level.
• A:N (None) — no direct availability impact.

Business impact. Any application that derives cookie domain or path from request data is potentially affected. The most realistic consequences are session-security weakening (turning an HttpOnly, Secure, SameSite=Strict session cookie into something weaker), cookie-scope confusion, and loss of CSRF/XSS mitigations that the application believed were in place. Combined with a separate XSS or CSRF flaw, the injected downgrade materially raises the chance of session compromise.

Blast radius. Because cookies is a dependency of Koa-based applications and other Node.js services, the exposure is ecosystem-wide rather than confined to one vendor. Organizations that cannot yet upgrade should inventory every service that forwards request-derived values into cookie scope options.

Detection Guidance

The detection artifacts below target the generic signature of the vulnerability class: semicolons or injected cookie attributes in request values that become domain/path, and anomalous Set-Cookie structures in responses. Because no public PoC exists, these rules are heuristic and should be tuned.

Sigma Rule

title: Set-Cookie Attribute Injection Attempt (CVE-2026-88038 class)
id: 3f9c2b41-7d6e-4a52-9c1e-88038c00a1b2
status: experimental
description: Detects request-supplied values containing semicolon-delimited cookie
  attributes being passed as cookie domain/path (cookies < 0.9.2, CWE-74).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88038
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_delimiter:
    c-uri|contains:
      - ';SameSite='
      - ';Secure'
      - ';HttpOnly'
      - ';Domain='
      - ';Path='
  selection_method:
    cs-method:
      - GET
      - POST
  condition: selection_delimiter and selection_method
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate application parameters that legitimately contain semicolon-separated lists
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.88038

YARA Rule

rule CVE_2026_88038_SetCookie_Attribute_Injection
{
    meta:
        description = "Detects Set-Cookie attribute injection patterns (cookies < 0.9.2, CWE-74)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88038"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $setcookie = "Set-Cookie" ascii nocase
        $delim     = "; " ascii

        $attr1 = "; SameSite=" ascii nocase
        $attr2 = "; Secure"    ascii nocase
        $attr3 = "; HttpOnly"  ascii nocase
        $attr4 = "; Domain="   ascii nocase
        $attr5 = "; Path="     ascii nocase

        $opt1 = "domain" ascii nocase
        $opt2 = "path"   ascii nocase

    condition:
        uint16(0) == 0x0A0D or true
        and $setcookie
        and $delim
        and 1 of ($attr*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88038 Set-Cookie Attribute Injection Attempt (cookies < 0.9.2)"; flow:established,to_server; http.uri; content:";"; content:"SameSite="; nocase; distance:0; within:40; reference:cve,2026-88038; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88038; classtype:attempted-admin; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:8803801; rev:1;)

alert http any any -> any any (msg:"CVE-2026-88038 Suspicious Set-Cookie Attribute on Response"; flow:established,to_client; http.header_names; content:"|0d 0a|Set-Cookie|0d 0a|"; http.header; content:"SameSite="; nocase; content:"Secure"; nocase; pcre:"/Set-Cookie\x3a[^\r\n]*;[^\r\n]*SameSitex3d[^\r\n]*;[^\r\n]*Secure[^\r\n]*;[^\r\n]*SameSite/I"; reference:cve,2026-88038; classtype:protocol-command-decode; sid:8803802; rev:1;)

Elastic Detection

sequence by source.ip, url.path with maxspan=5s
  [ network where event.action == "request" and
      network.protocol == "http" and
      url.query matches~ ".*;(SameSite=|Secure|HttpOnly|Domain=|Path=).*" ]
  [ network where event.action == "response" and
      http.response.headers.set_cookie : "*" and
      http.response.headers.set_cookie matches~ ".*;.*(SameSite=.*;.*Secure|HttpOnly|Domain=).*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval suspicious = mvappend(
    if(match(cs_uri, "(?i);(SameSite=|Secure|HttpOnly|Domain=|Path=)"), "uri_injection", null()),
    if(match(cs_uri_query, "(?i);(SameSite=|Secure|HttpOnly|Domain=|Path=)"), "query_injection", null()))
| where isnotnull(suspicious)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(suspicious) as vectors values(cs_user_agent) as user_agents
        by src_ip, cs_host, cs_uri_path
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-88038,">
  <rule id="880381" level="8">
    <if_sid>31100</if_sid>
    <field name="url">(?i);(SameSite=|Secure|HttpOnly|Domain=|Path=)</field>
    <description>CVE-2026-88038: Possible Set-Cookie attribute injection via semicolon-delimited value in request URI</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
  </rule>

  <rule id="880382" level="10" frequency="5" timeframe="120">
    <if_matched_sid>880381</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-88038: Repeated Set-Cookie attribute injection attempts from same source</description>
    <group>attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. Affected Versions is empty and no vendor fix or workaround is listed in the tracked data. Although the NVD description states the issue is fixed in cookies 0.9.2, no authoritative patch source corroborates this in the provided evidence. Treat as unpatched until verified against the upstream project.

1) Immediate mitigations

• Do not derive domain or path from untrusted or request-derived input. Keep both options application-set (hard-coded or drawn from a static allowlist of trusted hosts/paths), as the advisory's workaround states. This removes the injection primitive entirely and is the single most effective control.
• Allowlist validation at the application layer. Before passing a value to the domain or path option, validate it against a strict, cookie-relevant grammar (RFC 6265 host/path character sets) and reject any input containing ;, control characters, or unexpected attribute syntax.
• Enforce a Content-Security-Policy and rely on defense in depth. Because the injected downgrade is most impactful when combined with XSS, a strict CSP reduces the practical consequences of a HttpOnly downgrade.
• WAF coverage. Deploy a virtual patching rule (see Suricata/Sigma above) to flag semicolon-delimited cookie attribute patterns in request URIs and queries.

2) Patch / upgrade steps

• Inventory all Node.js services and their transitive dependency on cookies (including Koa-based applications using ctx.cookies). Use npm ls cookies or an SCA tool.
• Upgrade cookies to 0.9.2 or later once the release is independently verified (validate the fix description — RFC 6265 validation of domain and path — against the project's changelog and source before relying on it).
• Retest cookie issuance paths after upgrade to confirm that invalid domain/path values are now rejected rather than emitted.

3) Long-term hardening

• Adopt a secure-by-default cookie policy: Secure, HttpOnly, SameSite=Strict (or Lax where required) on all session and authentication cookies, asserted in code and verified in CI.
• Never forward request-controlled data into protocol token positions. Treat cookie attributes, headers, and similar structured fields as trusted-input-only.
• Add automated dependency scanning and SBOM tracking so future advisories against the cookies library and its dependents are detected quickly.
• Include Set-Cookie integrity checks in security test suites to catch attribute injection regressions.

References

1. NVD — CVE-2026-88038: https://nvd.nist.gov/vuln/detail/CVE-2026-88038
2. CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): https://cwe.mitre.org/data/definitions/74.html
3. RFC 6265 — HTTP State Management Mechanism (cookie grammar referenced as the fix): https://www.rfc-editor.org/rfc/rfc6265
4. RFC 7230 — HTTP/1.1 Message Syntax and Routing, Section 3.2 (field-content grammar): https://www.rfc-editor.org/rfc/rfc7230#section-3.2
5. cookies — npm package (upstream project source/changelog for version verification): https://www.npmjs.com/package/cookies

Threat actor / exploit-in-the-wild status: No public PoC, exploit code, or Nuclei template is available for this CVE. No exploit-in-the-wild evidence exists in the provided data, and CVE-2026-88038 is not listed in CISA KEV. EPSS has not been scored by FIRST.org. Exploitation requires an application-specific anti-pattern (untrusted data reaching the cookie domain/path option), which limits opportunistic mass exploitation but does not eliminate targeted abuse against misconfigured applications.