/ 
PAGI-Middleware-Session-Store-Cookie-0.001001
Security Advisories (1)
CVE-2026-5087 (2026-03-31)

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely. PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on systems without the device, such as Windows), then it will emit a warning that recommends the user install Crypt::URandom, and then return a string of random bytes generated by the built-in rand function, which is unsuitable for cryptographic applications. This modules does not use the Crypt::URandom module, and installing it will not fix the problem. The random bytes are used for generating an initialisation vector (IV) to encrypt the cookie. A predictable IV may make it easier for malicious users to decrypt and tamper with the session data that is stored in the cookie.

Changes for version 0.001001 - 2026-03-16

  • Initial release
  • AES-256-GCM encrypted client-side session storage
  • Implements PAGI::Middleware::Session::Store interface
  • set() returns encrypted blob as transport value
  • get() decrypts and verifies, returns undef for tampered/invalid data
  • No server-side storage needed
  • Runtime warning when /dev/urandom unavailable (insecure IV fallback)
  • Counter example app included

Modules

PAGI::Middleware::Session::Store::Cookie
Encrypted client-side session store

Examples

Other files