MediumGHSA-72xf-g2v4-qvf3CVE-2023-26136
tough-cookie Prototype Pollution vulnerability
Published 1 Jul 2023 · Updated 10 Sept 2026
Affected package
tough-cookienpm
- Affected
- <4.1.3
- Fixed in
- 4.1.3
Update to the fixed version for your release line, for example:
npm install tough-cookie@4.1.3Details
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Is GHSA-72xf-g2v4-qvf3 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected tough-cookie, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-26136
- Linkgithub.com/salesforce/tough-cookie/issues/282
- Linkgithub.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e
- Packagegithub.com/salesforce/tough-cookie
- Linkgithub.com/salesforce/tough-cookie/releases/tag/v4.1.3
- Linklists.debian.org/debian-lts-announce/2023/07/msg00010.html
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2
- Linklists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ
- Linksecurity.netapp.com/advisory/ntap-20240621-0006
- Linksecurity.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.