# What changed in js-cookie

> 5 changes in js-cookie 3 from its official release notes, upgrade guides and advisories: 1 security. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/js-cookie/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## js-cookie 3

### Security

- Prevents cookie attribute injection associated with CVE-2026-46625. (3.0.7) — [release notes](https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7), [security advisory](https://github.com/advisories/GHSA-QJX8-664M-686J)

### Fixes and other changes

- ES5 compatibility was restored after being inadvertently broken in 3.0.7. (3.0.8) — [release notes](https://github.com/js-cookie/js-cookie/releases/tag/v3.0.8)
- The Node version restriction was lifted after 3.0.7 inadvertently restricted Node to version 20 or newer. (3.0.8) — [release notes](https://github.com/js-cookie/js-cookie/releases/tag/v3.0.8)
- Ensures consistent behavior between get('name') and get(). (3.0.7) — [release notes](https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7)
- The package is published to npm exclusively through a trusted publisher. (3.0.7) — [release notes](https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7)