CVE-2026-46625 js-cookie CVE debrief

Who should care

Defenders responsible for systems using the js-cookie library prior to version 3.0.7 should assess exposure and prioritize upgrading to the patched version. This includes reviewing and updating affected systems, monitoring for potential security issues, and verifying the integrity of cookie attributes.

Why it matters

CVE-2026-46625 is a vulnerability in the JavaScript Cookie API, specifically in the js-cookie library prior to version 3.0.7, allowing for prototype hijacking. Defenders should prioritize upgrading to version 3.0.7 or later to mitigate this vulnerability.

• Potential security issues due to prototype hijacking
• Need to upgrade to version 3.0.7 or later to mitigate vulnerability
• Possible security risks if affected systems are not updated

Technical summary

The vulnerability is caused by the internal assign() helper in js-cookie copying properties with for...in + plain assignment, which can lead to a per-instance prototype hijack. The issue is triggered when the source object is produced by JSON.parse. This allows an attacker to set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. The vulnerability has been patched in version 3.0.7, and defenders should prioritize upgrading to this version or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize upgrading to version 3.0.7 or later to mitigate this vulnerability.

Recommended defensive actions

• Upgrade to version 3.0.7 or later
• Review and update affected systems
• Monitor for potential security issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the internal assign() helper in js-cookie copying properties with for...in + plain assignment, which can lead to a per-instance prototype hijack. The issue is triggered when the source object is produced by JSON.parse. Defenders should verify affected systems and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.