Search for packages
| purl | pkg:npm/tough-cookie@2.2.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3buh-pfq7-9kf2
Aliases: GMS-2017-210 |
Regular Expression Denial of Service The `tough-cookie` module is vulnerable to regular expression denial of service. Input of around k characters is required for a slow down of around 2 seconds. Unless node was compiled using the `-DHTTP_MAX_HEADER_SIZE=` option the default header max length is kb so the impact of the ReDoS is limited to around seconds of blocking. |
Affected by 1 other vulnerability. |
|
VCID-am2z-v7gj-nqch
Aliases: CVE-2017-15010 GHSA-g7q5-pjjr-gqvp |
Uncontrolled Resource Consumption An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU. |
Affected by 1 other vulnerability. |
|
VCID-gcrq-1at1-bygq
Aliases: CVE-2016-1000232 GHSA-qhv9-728r-6jqg |
Improper Input Validation NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0. |
Affected by 3 other vulnerabilities. |
|
VCID-wjaq-7np6-z3bk
Aliases: CVE-2023-26136 GHSA-72xf-g2v4-qvf3 |
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Versions of the package tough-cookie before 4.1.3 is vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. |
Affected by 0 other vulnerabilities. |
|
VCID-z4vf-knv2-7qeb
Aliases: GMS-2016-49 |
ReDoS via long string of semicolons Tough-cookie contain a vulnerable regular expression that, under certain conditions involving long strings of semicolons in the "Set-Cookie" header, causes the event loop to block for excessive amounts of time. |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||