In 5.3.8 req.cookies is a mandatory property if the validateSecurity in middleware is set to the default value true. When it's undefined, the REST request returns 401 Unauthorized. In the previous version (5.3.7), the express-openapi-validator allowed other validation to determine that.
This line is problematic https://github.com/cdimascio/express-openapi-validator/pull/949/files#diff-da8cb83e654297ed25e59f84342ccc638845cfb2126ed2952b1d9e477eebd1a2R236 If req.cookies is undefined, we have undefined['something'], which throws 'Uncaught TypeError: Cannot read properties of undefined'.