Description
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cookiejar | < 2.1.4 | 2.1.4 |
| — | org.webjars.npm:cookiejar | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-cookiejar | 2.1.4+~2.1.2-1 | — |
| Debian 13 | node-cookiejar | 2.1.4+~2.1.2-1 | — |
| Debian 12 | node-cookiejar | 2.1.4+~2.1.2-1 | — |
| Debian 10 | node-cookiejar | 2.0.1-1+deb10u1 | DLA-3561-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars.npm:cookiejar | <= 2.1.3 | — | GHSA-h452-7996-h45h |
| npm | cookiejar | < 2.1.4 | 2.1.4 | GHSA-h452-7996-h45h |
Advisories 2
- DLA-3561-1 node-cookiejar - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
References
- https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681
- https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73
- https://github.com/bmeck/node-cookiejar/pull/39
- https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5
- https://lists.debian.org/debian-lts-announce/2023/09/msg00008.html