diff --git a/package-lock.json b/package-lock.json
index 430b1f8a9..6630fdf90 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,7 +19,7 @@
         "chalk-template": "1.1.2",
         "chokidar": "5.0.0",
         "compression": "1.8.1",
-        "cookie": "1.1.1",
+        "cookie": "2.0.1",
         "cookie-parser": "1.4.7",
         "diff": "9.0.0",
         "dotenv": "17.4.2",
@@ -3032,12 +3032,12 @@
       "license": "MIT"
     },
     "node_modules/cookie": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
-      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-2.0.1.tgz",
+      "integrity": "sha512-yuToqVvRrj6pfDXREyQAAv8SkAEk/8GS3jQRTiUMm66TVtBYmqQeoEjL2Lmq8Rpo6271vH76InTChTitEAm65w==",
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">=22"
       },
       "funding": {
         "type": "opencollective",
diff --git a/package.json b/package.json
index f50368abf..5f97b5c83 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
     "chalk-template": "1.1.2",
     "chokidar": "5.0.0",
     "compression": "1.8.1",
-    "cookie": "1.1.1",
+    "cookie": "2.0.1",
     "cookie-parser": "1.4.7",
     "diff": "9.0.0",
     "dotenv": "17.4.2",
diff --git a/src/server/utils.js b/src/server/utils.js
index b71bff88f..f3e4ee32c 100644
--- a/src/server/utils.js
+++ b/src/server/utils.js
@@ -16,7 +16,8 @@ import { Socket } from 'net';
 import { PassThrough } from 'stream';
 import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
-import cookie from 'cookie';
+// eslint-disable-next-line import/no-unresolved
+import { parseCookie } from 'cookie';
 import { unified } from 'unified';
 import rehypeParse from 'rehype-parse';
 import { select } from 'hast-util-select';
@@ -281,7 +282,7 @@ window.LiveReloadOptions = {
 
     if (!opts.cookies) {
       // only pass through hlx-auth-token cookie
-      const cookies = cookie.parse(headers.cookie || '');
+      const cookies = parseCookie(headers.cookie || '');
       delete headers.cookie;
       const hlxAuthToken = cookies['hlx-auth-token'];
       if (hlxAuthToken) {