tough-cookie Prototype Pollution vulnerability

CRITICO 9.8CVE-2023-26136 · GHSA-72xf-g2v4-qvf3 · Published 01/07/2023 · updated 17/06/2026

In breve

CVE-2023-26136 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda tough-cookie (salesforce), tough-cookie.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.6%, superiore al 85.5% delle vulnerabilità.
Correzione: aggiornare a 4.1.3 o successiva.

Package	Affected versions	Patched versions
tough-cookie salesforce	`< 4.1.3`	`4.1.3`
tough-cookie npm	`< 4.1.3`	`4.1.3`

Description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

NVD description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

References

Altre vulnerabilità di tough-cookie

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free