Description
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | rh-nodejs4-nodejs-tough-cookie | 2.3.3-2.el6 | RHSA-2017:2912 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | nodejs +2 | 0.10.47-2.el7 | RHSA-2016:2101 |
| Red Hat OpenShift 3 | nodejs-tough-cookie | 2.3.1-1.el7 | RHSA-2016:2101 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | tough-cookie | < 2.3.0 | 2.3.0 | GHSA-qhv9-728r-6jqg |
Advisories 3
- RHSA-2017:2912 Red Hat Security Advisory: rh-nodejs4-nodejs-tough-cookie security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2101 Red Hat Security Advisory: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
References
- RHSA-2016:2101 vendor-advisory
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/
- RHSA-2017:2912 vendor-advisory
- https://www.npmjs.com/advisories/130
- https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae
- https://access.redhat.com/security/cve/cve-2016-1000232
- https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534