---
title: "cookie-signature security advisories"
description: "1 known security advisory for cookie-signature, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/cookie-signature/security
lang: en
---

[Packages](https://inlinr.com/packages)

# cookie-signature

1.2.2 · 29 Oct 2024 MIT 198.1M / week [Repository](https://github.com/visionmedia/node-cookie-signature) [Homepage](https://github.com/visionmedia/node-cookie-signature#readme) [npm](https://www.npmjs.com/package/cookie-signature) [Atom feed](https://inlinr.com/packages/feed/cookie-signature)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                             |
| ---- | ------ | --------------------------------------------------------------------------- |
|      | 1.2.2  | Safe from 1.0.4                                                             |
|      | 0.0.1  | 1 open advisory, worst moderate  · last release Oct 2012, no longer updated |

- Moderate  
[cookie-signature Timing Attack](https://inlinr.com/advisories/GHSA-92vm-wfm5-mxvv)GHSA-92vm-wfm5-mxvv · 6 Jan 2020  
fixed in 1.0.4

### Quality and security signals

What [npm](https://www.npmjs.com/package/cookie-signature) and [deps.dev](https://deps.dev/npm/cookie-signature) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Reading releases, release notes and advisories…

Registry facts last checked 2 Nov 2026\. Releases and advisories last read 2 Nov 2026.