CVE-2026-46625
1 advisory.
npm/js-cookie CVE-2026-46625: high 7.5, EPSS 0.99%
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Action: Upgrade js-cookie to 3.0.7 or later.
npm i js-cookie@3.0.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.7 | - |
Fixed versions
| 3.0.7 |
Sources
- osv: GHSA-qjx8-664m-686j
- https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j
- https://nvd.nist.gov/vuln/detail/CVE-2026-46625
- https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020
- https://github.com/js-cookie/js-cookie
- https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7
CVE-2026-46625 · published · modified · JSON