Description
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Recommendation
Update the tough-cookie package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.1.3
- Patched version(s): 4.1.3
References
- GHSA-72xf-g2v4-qvf3
- security.snyk.io
- lists.debian.org
- lists.fedoraproject.org
- security.netapp.com
- CVE-2023-26136
- CWE-1321
- CAPEC-310
- OWASP 2021-A6
Related Issues
- min-document vulnerable to prototype pollution - CVE-2025-57352
- Vite bypasses server.fs.deny when using ?raw?? - CVE-2025-30208
- GetmeUK ContentTools Cross-Site Scripting (XSS) - CVE-2025-2699
- node-gettext vulnerable to Prototype Pollution - CVE-2024-21528
- Tags:
- npm
- tough-cookie
Anything's wrong? Let us know Last updated on June 21, 2024