tough-cookie Prototype Pollution vulnerability

KRITISCH 9.8CVE-2023-26136 · GHSA-72xf-g2v4-qvf3 · Published 01/07/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-26136 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in tough-cookie (salesforce), tough-cookie.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.6%, höher als bei 85.5% aller Schwachstellen.
Abhilfe: auf 4.1.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
tough-cookie salesforce	`< 4.1.3`	`4.1.3`
tough-cookie npm	`< 4.1.3`	`4.1.3`

Description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

NVD description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

References

Weitere Schwachstellen in tough-cookie

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free