--- title: "GHSA-pxg6-pf52-xh8x: cookie accepts cookie name, path, and domain with out of bounds characters" description: "Low severity. cookie accepts cookie name, path, and domain with out of bounds characters. Affects cookie; fixed in 0.7.0." url: https://inlinr.com/advisories/GHSA-pxg6-pf52-xh8x lang: en --- [Packages](https://inlinr.com/packages) / [cookie](https://inlinr.com/packages/cookie) / [Security](https://inlinr.com/packages/cookie/security) Low Vulnerability GHSA-pxg6-pf52-xh8x CVE-2024-47764 Published 4 Oct 2024 # cookie accepts cookie name, path, and domain with out of bounds characters Your version Affected releases · [cookie](https://inlinr.com/packages/cookie) - 0.6.x and older 0.0.0 – 0.6.0 No fix, no longer updated 0.6.x has no fix yet; the newest fixed line: ``` npm install cookie@0.7.0 ``` Every release on a timeline 2.x 1. Not affected 2.0.0 – 2.0.1 2 releases, latest 0.x 1. Affected 0.0.0 – 0.6.0 25 releases 2. Fixed 0.7.0 – 0.7.2 3 releases 35 stable releases of cookie, oldest to newest, one row per major. ## What happens Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize("userName=; Max-Age=2592000; a", value)` would result in `"userName=; Max-Age=2592000; a=test"`, setting `userName` cookie to `