http upstream sticky: `$host` can inject cookie attributes through `domain`

Bug Overview

When I configure the standard ngx_http_upstream_sticky_module with domain=$host, a semicolon in the client‑controlled Host header is copied into the Set‑Cookie header. As a result, nginx emits an unintended additional cookie attribute instead of validating the runtime cookie domain.

For example, the request:

Host: victim.example;Secure

produces:

Set‑Cookie: route=...; domain=victim.example;secure; path=/

Expected Behavior

When the evaluated value of domain contains characters that are not valid for a cookie domain, nginx should reject the value or omit the Domain attribute.

It should not serialize the value directly into Set‑Cookie in a way that allows additional cookie attributes to be injected.

Steps to Reproduce the Bug

1. Start a local HTTP backend:

python3 -m http.server 8080 --bind 127.0.0.1

1. Start nginx 1.31.5 with the configuration provided below.
2. Send the following request:

curl --http1.1 -i \
 -H 'Host: victim.example;Secure' \
 http://127.0.0.1:8081/

1. nginx returns a response similar to:

HTTP/1.1 200 OK
Set‑Cookie: route=...; domain=victim.example;secure; path=/

The secure token is emitted as an additional cookie attribute. The same behavior can be observed with other cookie attributes, for example:

Host: victim.example;HttpOnly
Host: victim.example;SameSite=Lax
Host: victim.example;Max‑Age=0

NGINX Configuration

worker_processes 1; events { worker_connections 64; } http { access_log off; upstream backend { server 127.0.0.1:8080; sticky cookie route domain=$host path=/; } server { listen 8081; server_name _; location / { proxy_pass http://backend; } } }

NGINX version and build configuration options

The output of nginx -V:

nginx version: nginx/1.31.5
built by gcc 11.4.0 (Ubuntu 11.4.0‑1ubuntu1~22.04.3)
configure arguments: --prefix=/tmp/nginx‑run‑1.31.5 --with‑cc‑opt='‑O0 ‑g'

Commit:

231a60ee3e90a43b829b9ca0a3013a8359b98d7e

Environment where NGINX is being built and/or deployed

• Target deployment platform: Local Linux environment
• Target OS: Ubuntu 22.04.5 LTS
• Backend: Python 3 HTTP server

Architecture where NGINX is being built and/or deployed

Linux ASANSYMLINKOVERWRITE 5.15.0‑152‑generic #162‑Ubuntu SMP Wed Jul 23 09:48:42 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

NGINX Debug Log

Not provided. The tested nginx binary was not compiled with --with‑debug. The issue is reproducible from the HTTP response header without requiring a debug log.

Additional Context

No response