CVE-2026-111714 json
tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
published 24d ago modified 19d ago also EUVD-2026-103006
- cvss
- 3.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Patch / fix
- AmauriC tarteaucitron.js 1.37.0
Is CVE-2026-111714 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19d ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- AmauriC tarteaucitron.js
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/AmauriC/tarteaucitron.js/commit/60faaba5fd541cad770549d422fc4ac7de657e56
patch
-
github.com
/AmauriC/tarteaucitron.js/releases/tag/v1.37.0
release-notes
-
github.com
/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2169-L2175
technical-description
-
vulncheck.com
/advisories/tarteaucitron-js-before-1.37.0-redos-via-unescaped-cookie-name-in-cookie-purge
third-party-advisory
Sources
- CVE List CVE-2026-111714
- NVD CVE-2026-111714
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.