Regular Expression Denial of Service in Tarteaucitron.js by AmauriC
CVE-2026-111714

2.3LOW

Key Information:

Vendor

Amauric

Status
Tarteaucitron.js
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111714?

The tarteaucitron.js library prior to version 1.37.0 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability. This issue arises when attackers exploit unescaped cookie names passed to the cookie.purge function, potentially freezing web pages. Attackers can manipulate the input by setting a malicious cookie from a sibling subdomain or by injecting a 'purgeBtn' element with specially crafted data-cookie patterns that lead to catastrophic backtracking. Such exploits significantly hinder page functionality and affect user experience.

Affected Version(s)

tarteaucitron.js 0 < 1.37.0

References

https://github.com/AmauriC/tarteaucitron.js/commit/60faab...
patch
https://github.com/AmauriC/tarteaucitron.js/releases/tag/...
release-notes
https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani
.