Repository navigation
Update dependency js-cookie to v3 [SECURITY] - #1883
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
dependencies
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/npm-js-cookie-vulnerability
branch
2 times, most recently
from
September 24, 2026 09:06
6e0abfe to
f737d22
Compare
renovate
Bot
force-pushed
the
renovate/npm-js-cookie-vulnerability
branch
from
October 5, 2026 17:12
f737d22 to
c6683d4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.2.1→3.0.7JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
CVE-2026-46625 / GHSA-qjx8-664m-686j
More information
Details
Summary
js-cookie's internalassign()helper copies properties withfor...in+ plain assignment. When the source object is produced byJSON.parse, the JSON object's"__proto__"member is an own enumerable property, so thefor…inenumerates it and thetarget[key] = source[key]write triggers theObject.prototype.__proto__setter on the freshtarget({}). The result is a per-instance prototype hijack:Object.prototypeitself is untouched, but the mergedattributesobject now inherits attacker-controlled keys.Because the consuming
set()function then enumerates the merged object with anotherfor...in, every key the attacker placed on the polluted prototype lands in the resultingSet-Cookiestring as an attribute pair. The attacker can setdomain=,secure=,samesite=,expires=, andpath=on cookies whose attributes the developer thought were locked down.Impact
Any application that forwards a JSON-derived object as the
attributesargument toCookies.set,Cookies.remove,Cookies.withAttributes, orCookies.withConverteris vulnerable. This is the standard pattern when cookie configuration comes from a backend:A payload of
{"__proto__":{"domain":"evil.example","secure":"false","samesite":"None"}}causes js-cookie to emit:Affected code
Proof of concept
Node 22.11.0, no third-party deps:
Environment setup
PoC
Execution:
Suggested patch
Equivalent one-liner alternative - iterate own names only and filter:
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
js-cookie/js-cookie (js-cookie)
v3.0.7Compare Source
eb3c40e)Partitionedattribute to readme (b994768)4dc71be)get('name')+get()(1953d30)v3.0.6Compare Source
v3.0.5Compare Source
v3.0.4Compare Source
v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
v3.0.0Compare Source
defaultsin favor of a builder: now to supply an api instance with particular predefined (cookie) attributes there'sCookies.withAttributes(), e.g.:attributesproperty; it's an immutable object and unlikedefaultscannot be changed to configure the api.Cookies.converter, which allows for implementing self-contained custom converters providing the same behavior:withConverter()no longer accepts a function as argument to be turned into a read converter. It is now required to always pass an object with the explicit type(s) of converter(s):converterproperty; it's an immutable object and cannot be changed to configure the api.modulefield inpackage.jsonpoints to an ES module variant of the library.browserfield instead ofmaininpackage.json(for the UMD variant of the library).getJSON()and automatic stringifying inset(): useCookies.set('foo', JSON.stringify({ ... }))andJSON.parse(Cookies.get('foo'))instead.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.