tough-cookie Prototype Pollution vulnerability

Description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Recommendation

Update the tough-cookie package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.1.3
• Patched version(s): 4.1.3

References

• GHSA-72xf-g2v4-qvf3
• security.snyk.io
• lists.debian.org
• lists.fedoraproject.org
• security.netapp.com
• CVE-2023-26136
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• protobufjs Prototype Pollution vulnerability - CVE-2023-36665
• plotly.js prototype pollution vulnerability - CVE-2023-46308
• js-toml Prototype Pollution Vulnerability - CVE-2025-54803
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-amd - CVE-2025-13465

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

tough-cookie