Parse HTTP Set-Cookie headers in JavaScript, converting one or more set-cookie values into JavaScript cookie objects. It’s useful for turning cookie header data from strings, Node.js response objects, or fetch Response objects into structured data (array by default, or a name to cookie map with the `map` option).
Project status
- Actively maintained: the upstream was pushed on 2026-10-30, and updates have continued frequently through October.
- The cadence is uneven but recently rapid, with several updates in October after earlier updates spaced weeks to months apart.
AI summary generated
Recent updates
v3.2.2
The publisher provided no release notes. The diff spans v2.7.3 to v3.2.2 and includes the v3 ESM/CJS packaging and API transition, automatic splitting of combined cookie headers, TypeScript definitions, and several cookie parsing fixes and security hardening changes.
BreakingSecurityFeaturesv2.7.3
The publisher provided no release notes for v2.7.3. The code adds a cookie parsing security fix that ignores attributes named `name` or `value`, changes the npm publish tag to `backports`, and updates development dependencies.
Securityv3.2.1
This release (v3.2.1) makes parsing of the expires and max-age attributes more observable by emitting console.error messages when those values cannot be parsed. The actual parsed cookie output continues to drop those attributes, but invalid timestamp inputs now produce an additional side effect unless silent mode is enabled.
v3.2.0
v3.2.0 introduces stricter handling of cookie attributes that would otherwise interfere with the parsed cookie object, and expands how the options.silent flag suppresses console warnings and errors. The release notes section in the provided release payload is empty, so the documented behavior changes must be inferred from the code diff and updated docs/tests.
BreakingSecurityv3.1.4
This release contains a small set of parsing behavior changes for the Set-Cookie parser, focused on handling invalid Max-Age and Expires attribute values. No publisher release notes were provided for v3.1.4, so the only authoritative details come from the code diff and updated changelog entries.
v3.1.3
Version v3.1.3 changes how set-cookie name/value pairs are parsed, specifically trimming whitespace around the cookie name and value per RFC 6265 5.2 (SP and HTAB). No release notes were provided by the publisher, so the behavioral impact is primarily revealed by the code diff and tests.
Breakingv3.1.2
No publisher release notes were provided for v3.1.2. The code change is a small robustness fix in set-cookie parsing, plus minor documentation and a dev dependency bump.
v3.1.1
v3.1.1 primarily adjusts Set-Cookie parsing so whitespace around attribute names and values is handled correctly. The diff also updates the GitHub Actions workflow to newer Node setup and checkout actions, and bumps a couple of dev-only dependency entries in the lockfile.
v3.1.0
Release v3.1.0 was published on 2026-03-20, but the publisher did not provide release notes. No documented features, fixes, breaking changes, or dependency/security updates are described in the provided information.
v3.0.1
No release notes were provided for v3.0.1. The code changes are limited to packaging and release automation, with the workflow now building a CJS version before publishing to npm.
v3.0.0
v3.0.0 includes a major packaging and API shift, adding ESM support, generating a CJS build, and changing how combined Set-Cookie header strings are handled. The provided release notes contain no content, so the actual behavioral changes must be inferred from the code diff.
Featuresv2.7.2
v2.7.2 hardens set-cookie parsing to mitigate prototype pollution and avoid logging potentially sensitive cookie values during decode errors. The code change also includes a few parsing robustness tweaks (for example, handling invalid max-age values) and updates test coverage for prototype pollution cases.
Securityv2.7.1
The v2.7.1 release contains minimal functional change in the library code, but it does include a likely behavioral change in how `parse()` handles the `options` argument. The remaining changes appear to be documentation and repo metadata updates.
v2.7.0
v2.7.0 mainly extends set-cookie-parser to recognize the Set-Cookie Partitioned attribute and map it to a structured cookie field. Alongside this, the repo adds/updates documentation (README, CHANGELOG) and modernizes the GitHub Actions workflow and development tooling versions.
Featuresv2.6.0
v2.6.0 updates the set-cookie parsing logic to better follow the RFC6265bis name-value parsing rules, and adds support for parsing fetch Response objects via headers.getSetCookie(). The release also includes test coverage for the updated edge-case behavior and some minor project/tooling changes.
BreakingFeaturesv2.5.0
Release v2.5.0 was published on 2022-06-04, but the publisher provided no release notes content. As a result, this report cannot confirm new features, breaking changes, bug fixes, or security updates from the release notes.