USN-9080-1: tough-cookie vulnerability

Q: What configuration is required for this issue to be exploitable?

The affected application must use tough-cookie with the rejectPublicSuffixes option disabled. The provided information does not indicate that the default configuration is affected.

Q: What could an attacker do if they can exploit this issue?

An attacker may be able to cause prototype pollution that modifies application behavior. This could result in a denial of service or another unspecified impact.

Q: Which systems should be prioritized for triage?

Prioritize Ubuntu systems running applications that depend on the ubuntu/node-tough-cookie package and have disabled rejectPublicSuffixes. Applications that process attacker-controlled cookies are the most relevant candidates for review.

Published Nov 12, 2026

Updated

It was discovered that tough-cookie incorrectly handled cookies when the rejectPublicSuffixes option was disabled, leading to prototype pollution. An attacker could possibly use this issue to modify the behavior of applications using tough-cookie, resulting in a denial of service, or another unspecified impact.

Affected Software

9 affected componentsFixes available

All of the following

ubuntu/node-tough-cookie<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=22.04

All of the following

ubuntu/node-tough-cookie<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/node-tough-cookie<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

ubuntu/node-tough-cookie<2.3.2+dfsg-1ubuntu0.1~esm1

2.3.2+dfsg-1ubuntu0.1~esm1

ubuntu/node-tough-cookie<3.0.0-1ubuntu0.1~esm1

3.0.0-1ubuntu0.1~esm1

ubuntu/node-tough-cookie<4.0.0-2ubuntu0.1~esm1

4.0.0-2ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/node-tough-cookie to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/node-tough-cookie to a version that resolves this vulnerability.
Fixed in 2.3.2+dfsg-1ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/node-tough-cookie to a version that resolves this vulnerability.
Fixed in 3.0.0-1ubuntu0.1~esm1
Upgrade
Upgrade ubuntu/node-tough-cookie to a version that resolves this vulnerability.
Fixed in 4.0.0-2ubuntu0.1~esm1

Event History

Nov 12, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What configuration is required for this issue to be exploitable?

The affected application must use tough-cookie with the rejectPublicSuffixes option disabled. The provided information does not indicate that the default configuration is affected.

What could an attacker do if they can exploit this issue?

An attacker may be able to cause prototype pollution that modifies application behavior. This could result in a denial of service or another unspecified impact.

Which systems should be prioritized for triage?

Prioritize Ubuntu systems running applications that depend on the ubuntu/node-tough-cookie package and have disabled rejectPublicSuffixes. Applications that process attacker-controlled cookies are the most relevant candidates for review.

USN-9080-1: tough-cookie vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What configuration is required for this issue to be exploitable?

What could an attacker do if they can exploit this issue?

Which systems should be prioritized for triage?

Company

Resources

Contact

Frequently Asked Questions

What configuration is required for this issue to be exploitable?

What could an attacker do if they can exploit this issue?

Which systems should be prioritized for triage?