-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability description clearly points to issues in how cookie names, paths, and domains are handled, specifically within the serialization process. The provided commit e10042845354fea83bd8f34af72475eed1dadf5c directly modifies the serialize function in index.js. The changes involve replacing a general regular expression (fieldContentRegExp) with more specific and stricter ones (cookieNameRegExp, cookieValueRegExp, domainValueRegExp, pathValueRegExp) for validating these components. This indicates that the serialize function was the point where the insufficient validation occurred, making it the vulnerable function. The tests in test/serialize.js were also updated to reflect these new, stricter validation rules, further confirming that serialize is the function of interest.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cookie | npm | < 0.7.0 | 0.7.0 |
Ongoing coverage of React2Shell