CVE-2026-111714
tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
AmauriC tarteaucitron.js
CVSS
2.3LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.37.0tarteaucitron.jsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Text from CVE List
Affected versions 1
- tarteaucitron.jsaffected: all versions before 1.37.0CVE List
References 4
- github.com/AmauriC/tarteaucitron.js/commit/60faaba5fd541cad770549d422fc4ac7de657e56Fixvia CVE List
- github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0Fixvia CVE List
- vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-redos-via-unescaped-cookie-name-in-cookie-purgeAdvisoryvia CVE List
- github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2169-L2175Referencevia CVE List