Prototype pollution in tough-cookie
Priority HIGH 81CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 13 fixed, 28 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02627 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial tough-cookie: 4.1.3tough-cookie (npm): 4.1.3Red Hat: 13 advisoriesRed Hat: 13 fixed, 28 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | tough-cookie | before 4.1.3 | 4.1.3 | Patch available | CNA |
| — | tough-cookie (npm) | before 4.1.3 | 4.1.3 | Patch available | GHSA-72xf-g2v4-qvf3 |
- tough-cookie Vendor— Affected before 4.1.3 Fixed in 4.1.3 Patch available CNA
- tough-cookie (npm) Vendor— Affected before 4.1.3 Fixed in 4.1.3 Patch available GHSA-72xf-g2v4-qvf3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:salesforce:tough-cookie:*:*:*:*:*:node.js:*:* | before 4.1.3 | Vulnerable | Salesforce |
- cpe:2.3:a:salesforce:tough-cookie:*:*:*:*:*:node.js:*:* Versions before 4.1.3 Vulnerable ·Salesforce
Remediation
- Fix · CNA tough-cookie Fixed in 4.1.3
- Fix · GHSA-72xf-g2v4-qvf3 tough-cookie (npm) Fixed in 4.1.3 Advisory →
Red Hat 13 advisories
- RHSA-2025:0323 Released 2025-01-15 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.14.13 Bug Fix Update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
- RHSA-2025:0164 Released 2025-01-09 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.15.9 Bug Fix Update
- RHODF 4.15 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2025:0082 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
Show 10 more Red Hat advisories
- RHSA-2024:8676 Released 2024-10-30 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
- RHSA-2023:7222 Released 2023-11-15 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.8.2 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-ui-rhel8
- RHSA-2023:5006 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2023:5542 Released 2023-10-24 · Red Hat rating ImportantLogging Subsystem 5.5.17 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +7
- RHSA-2023:5541 Released 2023-10-20 · Red Hat rating ImportantLogging Subsystem 5.6.12 - Red Hat OpenShift security update
- RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +7
- RHSA-2023:5485 Released 2023-10-06 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el8eap +47
- RHSA-2023:5486 Released 2023-10-06 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el9eap +47
- RHSA-2023:5484 Released 2023-10-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el7eap +47
- RHSA-2023:5488 Released 2023-10-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update
- Red Hat JBoss Enterprise Application Platform io.netty.netty-handler-4.1.94.Final-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.76.0.redhat-00001.jar, org.jboss.hal.hal-console-3.3.19.Final-redhat-00001-resources.jar +2
- RHSA-2023:3998 Released 2023-07-12 · Red Hat rating ModerateLogging Subsystem 5.7.3 - Red Hat OpenShift security update
- RHOL 5.7 for RHEL 8 openshift-logging/logging-view-plugin-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Runtimes | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| Network Observability Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Certification for Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Discovery 1 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2023:7222 |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2025:0323 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2025:0164 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:0082 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2024:8676 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2023:5542 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2023:5541 |
| RHOL 5.7 for RHEL 8 | Fixed | RHSA-2023:3998 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:5484 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:5485 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:5486 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:5488 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5006 |
Not affected: 28 products
- .NET 6.0 on Red Hat Enterprise Linux
- 8Base-RHMTC-1.8
- Cryostat 2
- Logging Subsystem for Red Hat OpenShift
- OpenShift Service Mesh 2
- RHODF 4.14 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- RHOL 5.5 for RHEL 8
- RHOL 5.6 for RHEL 8
- RHOL 5.7 for RHEL 8
- Red Hat A-MQ Online
- Red Hat Advanced Cluster Security 3
- Red Hat Advanced Cluster Security 4
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift distributed tracing 2
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26136
- 2026-10-03 Alias added: GHSA-72xf-g2v4-qvf3
- 2026-10-27 Affected versions changed · Red Hat
References
Other 9
- https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3
- https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://github.com/salesforce/tough-cookie
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ
- https://security.netapp.com/advisory/ntap-20240621-0006
More Salesforce Tough-cookie vulnerabilities
- TI-2017-11015 A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module… CVSS 3.0HIGH 7.5
- TI-2016-09353 NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in… CVSS 3.0MEDIUM 5.3
Sources
- CVE-2023-26136 · CVE Program
- CVE-2023-26136 · NVD
- FIRST EPSS
- GHSA-72xf-g2v4-qvf3 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26136 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences