CVE-2024-47764 cookie accepts cookie name, path, and domain with out of bounds characters
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-47764?
CVE-2024-47764 is a medium-severity vulnerability in jshttp cookie, published on 4 Oct 2024.
Official description
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Weakness: CWE-74
Which versions are affected by CVE-2024-47764?
2 open source packages ship an affected version, including cookie.
| Package | Affected | Fixed in |
|---|---|---|
cookie npm | All versions | 0.7.0 |
cookie npm | All versions | 0.7.0 |
How do I fix CVE-2024-47764?
Upgrade cookie to 0.7.0 or later.
Is CVE-2024-47764 being exploited?
There is no known exploitation of CVE-2024-47764 in the wild and no public exploit code.
Sources
Also known as AZL-50067, AZL-50073, AZL-50085, AZL-50094, AZL-50114, CLEANSTART-2026-NQ54168 and 16 more.