Skip to content
OpenAdvisories

Package · npm

tough-cookie

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-26136 Public exploit

    tough-cookie Prototype Pollution vulnerability

    Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

    katib-suggestion-hyperopt katib-earlystopping katib-suggestion-hyperband katib-suggestion-pbt-enas Debian Ubuntu Azure Linux Wolfi npm
  • Medium 5.3
    CVE-2016-1000232

    ReDoS via long string of semicolons in tough-cookie

    NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability …

    tough-cookie npm