CVE-2026-46625: JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

Synopsis

This is a prototype hijack vulnerability in js-cookie, a widely used client-side JavaScript library for reading and writing browser cookies. An attacker who can influence cookie-related input processed by JSON.parse can manipulate the attributes of any cookie the application sets, including domain, secure, samesite, expires, and path, without needing authentication or user interaction. Successful exploitation allows an attacker to inject or override cookie attributes, undermining cookie security boundaries and enabling follow-on attacks such as session fixation or cookie theft across subdomains. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers malicious input over the network to any endpoint that passes JSON-parsed data into js-cookie's assign() helper.

• AuthenticationNot required

  No credentials are needed; the attacker only needs to supply a crafted JSON payload containing a __proto__ key.

• Victim interactionNot required

  Exploitation does not require any action from a user or developer; it occurs entirely during server- or client-side processing of the malicious input.

• Attack complexityDetail

  The exploit is reliable and condition-free: any JSON object with a __proto__ own enumerable property triggers the prototype setter on the target object without requiring timing tricks or environmental preconditions.

Blast Radius

• Attacker-controlled values appear as cookie attributes in the resulting Set-Cookie string, overriding domain, secure, samesite, expires, and path settings the developer intended to lock down.
• Overriding the domain attribute can extend a cookie's scope to sibling subdomains, making the cookie readable by attacker-controlled or compromised endpoints.
• Stripping or downgrading the secure attribute causes the browser to transmit the cookie over plain HTTP, exposing its value to network interception.
• Manipulating samesite or path attributes weakens cross-site request forgery protections and broadens the set of requests that carry the affected cookie.