Tough Cookie

tough-cookie

Vendor: Salesforce • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-26136 1Salesforce 1Tough Cookie Nov 21, 2024 Jul 1, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in wh...Show more Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.Show less
CVE-2016-1000232 3Ibm RedhatSalesforce 3Api Connect Openshift Container PlatformTough Cookie Nov 21, 2024 Sep 5, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP heade...Show more NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.Show less
CVE-2017-15010 1Salesforce 1Tough Cookie May 13, 2026 Oct 4, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the applicati...Show more A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.Show less