TI-2026-75500 Aliases CVE-2026-111714 GHSA-h33v-xq5w-v2mw

Regular expression denial of service in tarteaucitron.js cookie purge

LOW 11CWE-1333Published 2026-10-16 · Updated 2026-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: High
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

tarteaucitron.js before 1.37.0 by AmauriC contains a regular expression denial of service flaw (CWE-1333) in cookie.purge, where unescaped cookie names are used to build a regular expression. An attacker who can set a cookie from a sibling subdomain, or inject a purge button element with a crafted data-cookie value, can make the page freeze when the purge button is clicked. The CVSS 4.0 vector shows low availability impact and requires user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00218 12th percentileScored 2026-11-07

Fix Fixed tarteaucitron.js (AmauriC): 1.37.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AmauriC	tarteaucitron.js	before 1.37.0	1.37.0	Patch available	CNA

tarteaucitron.js VendorAmauriC Affected before 1.37.0 Fixed in 1.37.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:amauri:tarteaucitronjs::::::::	—	—	AmauriC

cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:*:*:* Versions — — ·AmauriC

Remediation

Update tarteaucitron.js to version 1.37.0, which fixes the issue. The sources list no fixed version for any other product.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA tarteaucitron.js (AmauriC) Fixed in 1.37.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-16
AmauriC tarteaucitron.js 1.37.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-75499 Cross-site scripting in tarteaucitron.js via data-url attributePriority LOW 22
Show all 2 records →

Timeline

2026-10-16 Threatist record created from CVE-2026-111714
2026-10-16 Alias added: GHSA-h33v-xq5w-v2mw
2026-10-21 CISA SSVC decision points changed

References

Patch 1

https://github.com/AmauriC/tarteaucitron.js/commit/60faaba5fd541cad770549d422fc4ac7de657e56

Other 2

TI-2023-03379 Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js CVSS 3.1MEDIUM 5.4
TI-2025-04443 tarteaucitron.io < 1.9.5 - Contributor+ Stored XSS CVSS 3.1MEDIUM 4.7
TI-2026-65941 WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter CVSS 3.1CRITICAL 9.8
TI-2026-44356 WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
TI-2024-11523 WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1MEDIUM 6.5
TI-2024-12908 WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter CVSS 3.1HIGH 7.2

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences