Vulnerabilities

TI-2023-11360 CVE-2023-26136 · GHSA-72xf-g2v4-qvf3

Prototype pollution in tough-cookie

HIGH 81

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02627 Published 2023-07-01 Partial fix · 4.1.3 CWE-1321

TI-2016-09353 CVE-2016-1000232 · GHSA-qhv9-728r-6jqg

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in…

LOW 29

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.02356 Published 2018-09-05 Partial fix · 2.3.0 CWE-20

TI-2017-11015 CVE-2017-15010 · GHSA-g7q5-pjjr-gqvp

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module…

LOW 39

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03283 Published 2017-10-03 Fixed in 2.3.3 CWE-400

Vulnerabilities

Filters

Prototype pollution in tough-cookie

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in…

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module…