tough-cookie
npm3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting tough-cookiepage 1 of 1
- CVE-2016-1000232MEDIUMCVSS 5.3EG 5.3✓ Fixed in 2.3.02018-09-05
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client.…
- CVE-2017-15010HIGHCVSS 7.5EG 7.5✓ Fixed in 2.3.32017-10-04
A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an ex…
- CVE-2023-26136MEDIUMCVSS 6.5EG 6.5✓ Fixed in 4.1.32023-07-01
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are…
Check whether tough-cookie is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for tough-cookie CVEs against the assets you own.
Start Free Scan →