Description
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Published: 2026-10-16
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

tarteaucitron.js contains a regular expression denial of service flaw in the cookie.purge function. Unescaped cookie names supplied by an attacker trigger catastrophic backtracking, rendering the page non‑responsive. The bug can be triggered by planting a cookie from a sibling subdomain or by injecting a purge button element that carries a malicious data‑cookie string; when the user clicks the button the page freezes.

Affected Systems

All releases of tarteaucitron.js before version 1.37.0 are affected. The library, developed by AmauriC, is used in web projects; users running versions 1.36.x or earlier should upgrade promptly.

Risk and Exploitability

With a CVSS score of 2.3 this issue is low severity and is not currently listed in the CISA KEV catalog. EPSS data is not available, indicating no known exploitation activity. The attack requires an attacker to supply or inject a cookie name, typically by setting a cookie from a related subdomain or manipulating the DOM. While the flaw can cause a denial of service to affected users, the likelihood of large‑scale impact remains limited.

Generated by OpenCVE AI on October 16, 2026 at 19:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade tarteaucitron.js to version 1.37.0 or later, where the vulnerable regex has been corrected.
  • Sanitize all data‑cookie attribute values in custom purge button elements to prevent unescaped characters that could trigger backtracking.
  • Discontinue or tightly restrict use of cookie.purge in the application, or add server‑side validation to enforce a whitelist of cookie names.

Generated by OpenCVE AI on October 16, 2026 at 19:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Title tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
First Time appeared Amauri
Amauri tarteaucitronjs
Weaknesses CWE-1333
CPEs cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:*:*:*
Vendors & Products Amauri
Amauri tarteaucitronjs
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Amauri Tarteaucitronjs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-21T21:23:25.025Z

Reserved: 2026-10-16T14:31:23.634Z

Link: CVE-2026-111714

cve-icon Vulnrichment

Updated: 2026-10-21T21:23:20.479Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T18:17:55.723

Modified: 2026-10-21T22:16:47.097

Link: CVE-2026-111714

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T19:45:14Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity