A Regular Expression Denial of Service (ReDoS) flaw was discovered in tarteaucitron.js that is triggered when processing the issuu_id parameter. The vulnerable regular expression can be fed a specially crafted value that causes the JavaScript engine to perform an exponential amount of work, leading to significant CPU usage and a potential denial of service for end users. The impact is limited to application availability; confidentiality and integrity are not directly affected.

The vulnerability affects all releases of tarteaucitron.js older than version 1.29.0 from the AmauriC project. Any deployment using the library prior to 1.29.0 is susceptible to ReDoS when a malicious issuu_id is supplied.

The CVSS score of 4.4 classifies this flaw as low to moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to provide a crafted issuu_id value, which could come from an attacker's controlled web page embedding the script or an injected request. The requirement for user-supplied input keeps the threat realistic in scenarios where the banner is exposed to untrusted input sources.