CVE-2026-111714: tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using tarteaucitron.js versions before 1.37.0 are affected. Exploitation requires a visitor to click a purge button after a malicious cookie name or purge-button data-cookie value has been supplied.
What attacker access is needed to trigger the issue?
An attacker can plant a cookie from a sibling subdomain, or inject a purgeBtn element whose data-cookie attribute contains a catastrophic-backtracking pattern. The attack does not require privileges, but it requires user interaction with the purge button.
What should be done if upgrading is not immediately possible?
Prevent untrusted injection of purgeBtn elements and avoid allowing sibling subdomains to set cookies usable by the affected site. Reducing access to the purge-button functionality also reduces the opportunity to trigger the page freeze.