CVE-2026-46625: JavaScript Cookie XSS Vulnerability

CVE-2026-46625 Overview

CVE-2026-46625 is a prototype pollution vulnerability in js-cookie, a widely used JavaScript API for handling browser cookies. The flaw exists in versions prior to 3.0.7 and resides in the library's internal assign() helper. When js-cookie merges a source object derived from JSON.parse, the parsed object's __proto__ key is enumerable. The helper copies it via plain assignment, hijacking the prototype of the freshly created attributes object. An attacker can inject cookie attributes such as domain, secure, samesite, expires, and path into the resulting Set-Cookie string. The issue is categorized under [CWE-1321] and was patched in version 3.0.7.

Critical Impact
Attackers can override cookie attributes that developers believed were locked down, weakening session security and enabling cookie scoping abuse.

Affected Products

js-cookie versions prior to 3.0.7
Web applications consuming js-cookie's set() function with attacker-influenced JSON input
Downstream JavaScript packages that wrap or bundle vulnerable js-cookie releases

Discovery Timeline

2026-06-10 - CVE-2026-46625 published to the National Vulnerability Database
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46625

Vulnerability Analysis

The vulnerability arises because the assign() helper in js-cookie iterates a source object using for...in and assigns each property to a target with target[key] = source[key]. When the source is produced by JSON.parse, the __proto__ key becomes an own enumerable property rather than a prototype reference. Assigning to target.__proto__ invokes the Object.prototype.__proto__ setter and replaces the prototype of the merged attributes object. The pollution is scoped to that instance, leaving Object.prototype itself unchanged.

The set() function then enumerates the merged attributes object with another for...in loop, which walks the polluted prototype chain. Every attacker-supplied key is emitted as an attribute pair in the final Set-Cookie header. This allows the attacker to write domain, path, expires, secure, and samesite attributes that the developer never authorized.

Root Cause

The root cause is unsafe property iteration combined with unfiltered assignment. The helper does not exclude __proto__ before writing, and it does not use Object.create(null) or Object.hasOwn() to constrain the merge.

Attack Vector

Exploitation requires that attacker-controlled JSON reach the set() call as the attributes argument. The attack is network-based, requires no authentication, and needs no user interaction. The impact targets integrity of cookie attributes rather than confidentiality or availability.

text

   for (var i = 1; i < arguments.length; i++) {
     var source = arguments[i]
     for (var key in source) {
+      if (key === '__proto__') continue
       target[key] = source[key]
     }
   }

Source: GitHub Commit eb3c40e. The patch skips the __proto__ key during assignment, preventing prototype hijack of the merged attributes object.

Detection Methods for CVE-2026-46625

Indicators of Compromise

Unexpected Set-Cookie headers containing domain, path, or expires values that do not match application defaults.
Client-side JSON payloads delivered to endpoints that subsequently call Cookies.set() with merged options.
Presence of js-cookie versions earlier than 3.0.7 in package-lock.json, yarn.lock, or shipped bundles.

Detection Strategies

Run software composition analysis (SCA) against application dependencies to flag js-cookie below 3.0.7.
Inspect runtime HTTP responses for Set-Cookie attributes that deviate from the application's documented cookie policy.
Audit code paths where JSON.parse output is passed directly into Cookies.set() as attribute options.

Monitoring Recommendations

Log and alert on outbound Set-Cookie headers whose domain or path differ from the originating host's policy baseline.
Monitor browser telemetry and CSP reports for cookies appearing on unexpected subdomains.
Track dependency updates in CI/CD pipelines and fail builds when vulnerable js-cookie versions are detected.

How to Mitigate CVE-2026-46625

Immediate Actions Required

Upgrade js-cookie to version 3.0.7 or later across all application bundles.
Rebuild and redeploy any front-end assets that statically include the vulnerable library.
Audit application code for direct passing of JSON.parse output into Cookies.set() and sanitize attribute inputs.

Patch Information

The fix is available in js-cookie 3.0.7. The patch adds an explicit __proto__ filter inside the assign() helper, preventing the prototype setter from being triggered during the merge. See the GitHub Release v3.0.7 and the GitHub Security Advisory GHSA-qjx8-664m-686j for full details.

Workarounds

Validate and allow-list cookie attribute keys before passing them to Cookies.set().
Construct attribute objects with Object.create(null) to eliminate prototype inheritance.
Strip __proto__, constructor, and prototype keys from any JSON-derived input prior to use.

bash

# Upgrade js-cookie to the patched release
npm install js-cookie@^3.0.7
npm audit --production