Skip to content

Product

debian/node-tough-cookie vulnerabilities

3 published CVES affecting debian/node-tough-cookie, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
1
High
1
Medium
0
Low
0
Unscored
1
CISA KEV
0

Latest debian/node-tough-cookie CVEs

Newest publication first

  2. CVE-2023-26136 tough-cookie Prototype Pollution vulnerability

    Published
    CriticalCVSS 9.8 EPSS 2.6%

    Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

  3. CVE-2017-15010 Regular Expression Denial of Service in tough-cookie

    Published
    HighCVSS 7.5 EPSS 3.3%

    A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.