CVE-2017-15010

Regular Expression Denial of Service in tough-cookie

7.5 HighFix available

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.28%Up 0.7 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2017-15010
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-400
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-15010
Updated: 2026-11-02

EUVDEUVD-2018-0269 No score

Record: EUVD-2018-0269
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g7q5-pjjr-gqvp 7.5

Regular Expression Denial of Service in tough-cookie

Affected versions of tough-cookie are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

If node was compiled using the -DHTTP_MAX_HEADER_SIZE however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.

Recommendation

Update to version 2.3.3 or later.

Record: GHSA-g7q5-pjjr-gqvp
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 7.5

Record: CVE-2017-15010
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-15010 7.5

Record: DEBIAN-CVE-2017-15010
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 11 moreShow less

OSVGHSA-g7q5-pjjr-gqvp 7.5

Regular Expression Denial of Service in tough-cookie

Affected versions of tough-cookie are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

Recommendation

Update to version 2.3.3 or later.

Record: GHSA-g7q5-pjjr-gqvp
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVRHSA-2017:2912 5.3

Red Hat Security Advisory: rh-nodejs4-nodejs-tough-cookie security update

Record: RHSA-2017:2912
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2017:2913 5.3

Red Hat Security Advisory: rh-nodejs6-nodejs-tough-cookie security update

Record: RHSA-2017:2913
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2018:1263 5.3

Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 release - RPMs

Record: RHSA-2018:1263
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-15010 7.5

Record: UBUNTU-CVE-2017-15010
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1772583199 No score

TuxCare security update for tough-cookie (3 CVEs)

TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 0.12.1-tuxcare.1.

Record: CLSA-2026-1772583199
Updated: 2026-11-02

OSVCLSA-2026-1773101696 No score

TuxCare security update for tough-cookie (3 CVEs)

TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 2.2.0-tuxcare.1.

Record: CLSA-2026-1773101696
Updated: 2026-11-02

OSVCLSA-2026-1774225211 No score

TuxCare security update for tough-cookie (3 CVEs)

TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 1.2.0-tuxcare.1.

Record: CLSA-2026-1774225211
Updated: 2026-11-02

OSVCLSA-2026-1784596273 No score

TuxCare security update for tough-cookie (2 CVEs)

TuxCare rebuilt tough-cookie to address 2 CVEs. Fixed in 2.2.2-tuxcare.1.

Record: CLSA-2026-1784596273
Updated: 2026-11-02

OSVCLSA-2026-1792164090 No score

TuxCare security update for tough-cookie (3 CVEs)

TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 2.2.1-tuxcare.1.

Record: CLSA-2026-1792164090
Updated: 2026-11-02

OSVCLSA-2026-1792164172 No score

TuxCare security update for tough-cookie (1 CVE)

TuxCare rebuilt tough-cookie to address 1 CVE. Fixed in 2.3.2-tuxcare.1.

Record: CLSA-2026-1792164172
Updated: 2026-11-02

Affected products

salesforce tough-cookie

Affected packages

Affected packages
Package	Affected	Fixed
`tough-cookie` npm	before 2.3.3	2.3.3
`tough-cookie` TuxCare:npm	0.12.1-tuxcare.0 up to 0.12.1-tuxcare.1, plus listed versions 0.12.1	0.12.1-tuxcare.1
`tough-cookie` TuxCare:npm	2.2.0-tuxcare.0 up to 2.2.0-tuxcare.1, plus listed versions 2.2.0	2.2.0-tuxcare.1
`tough-cookie` TuxCare:npm	1.2.0-tuxcare.0 up to 1.2.0-tuxcare.1, plus listed versions 1.2.0	1.2.0-tuxcare.1
`tough-cookie` TuxCare:npm	2.2.2-tuxcare.0 up to 2.2.2-tuxcare.1, plus listed versions 2.2.2	2.2.2-tuxcare.1
`tough-cookie` TuxCare:npm	2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions 2.2.1	2.2.1-tuxcare.1
`tough-cookie` TuxCare:npm	2.3.2-tuxcare.0 up to 2.3.2-tuxcare.1, plus listed versions 2.3.2	2.3.2-tuxcare.1
`node-tough-cookie` Debian:12	before 2.3.4+dfsg-1	2.3.4+dfsg-1
`node-tough-cookie` Debian:13	before 2.3.4+dfsg-1	2.3.4+dfsg-1
`node-tough-cookie` Debian:14	before 2.3.4+dfsg-1	2.3.4+dfsg-1

Show 92 moreShow less

Affected packages
Package	Affected	Fixed
`rh-nodejs4-nodejs-tough-cookie` Red Hat:rhel_software_collections:2::el6	before 0:2.3.3-2.el6	0:2.3.3-2.el6
`rh-nodejs4-nodejs-tough-cookie` Red Hat:rhel_software_collections:2::el7	before 0:2.3.3-2.el7	0:2.3.3-2.el7
`rh-nodejs6-nodejs-tough-cookie` Red Hat:rhel_software_collections:2::el6	before 0:2.3.3-1.el6	0:2.3.3-1.el6
`rh-nodejs6-nodejs-tough-cookie` Red Hat:rhel_software_collections:2::el7	before 0:2.3.3-1.el7	0:2.3.3-1.el7
`fh-system-dump-tool` Red Hat:mobile_application_platform:4.6	before 0:1.0.0-5.el7	0:1.0.0-5.el7
`fping` Red Hat:mobile_application_platform:4.6	before 0:3.10-4.el7map	0:3.10-4.el7map
`fping-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:3.10-4.el7map	0:3.10-4.el7map
`nagios` Red Hat:mobile_application_platform:4.6	before 0:4.0.8-8.el7map	0:4.0.8-8.el7map
`nagios-common` Red Hat:mobile_application_platform:4.6	before 0:4.0.8-8.el7map	0:4.0.8-8.el7map
`nagios-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:4.0.8-8.el7map	0:4.0.8-8.el7map
`nagios-devel` Red Hat:mobile_application_platform:4.6	before 0:4.0.8-8.el7map	0:4.0.8-8.el7map
`nagios-plugins` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-all` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-apt` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-breeze` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-by_ssh` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-cluster` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-dbi` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-dhcp` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-dig` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-disk` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-disk_smb` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-dns` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-dummy` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-file_age` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-flexlm` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-fping` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-game` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-hpjd` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-http` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-icmp` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ide_smart` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ifoperstatus` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ifstatus` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ircd` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ldap` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-load` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-log` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-mailq` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-mrtg` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-mrtgtraf` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-mysql` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-nagios` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-nt` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ntp` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ntp-perl` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-nwstat` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-oracle` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-overcr` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-perl` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-pgsql` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ping` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-procs` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-radius` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-real` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-rpc` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-sensors` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-smtp` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-snmp` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ssh` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-swap` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-tcp` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-time` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-ups` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-uptime` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-users` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`nagios-plugins-wave` Red Hat:mobile_application_platform:4.6	before 0:2.0.3-3.el7map	0:2.0.3-3.el7map
`perl-Crypt-CBC` Red Hat:mobile_application_platform:4.6	before 0:2.33-2.el7map	0:2.33-2.el7map
`perl-Crypt-DES` Red Hat:mobile_application_platform:4.6	before 0:2.05-20.el7map	0:2.05-20.el7map
`perl-Crypt-DES-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:2.05-20.el7map	0:2.05-20.el7map
`perl-Net-SNMP` Red Hat:mobile_application_platform:4.6	before 0:6.0.1-7.el7map	0:6.0.1-7.el7map
`phantomjs` Red Hat:mobile_application_platform:4.6	before 0:1.9.7-3.el7map	0:1.9.7-3.el7map
`phantomjs-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:1.9.7-3.el7map	0:1.9.7-3.el7map
`python-meld3` Red Hat:mobile_application_platform:4.6	before 0:0.6.10-1.el7map	0:0.6.10-1.el7map
`python-meld3-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:0.6.10-1.el7map	0:0.6.10-1.el7map
`qstat` Red Hat:mobile_application_platform:4.6	before 0:2.11-13.20080912svn311.el7map	0:2.11-13.20080912svn311.el7map
`qstat-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:2.11-13.20080912svn311.el7map	0:2.11-13.20080912svn311.el7map
`radiusclient-ng` Red Hat:mobile_application_platform:4.6	before 0:0.5.6-9.el7map	0:0.5.6-9.el7map
`radiusclient-ng-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:0.5.6-9.el7map	0:0.5.6-9.el7map
`radiusclient-ng-devel` Red Hat:mobile_application_platform:4.6	before 0:0.5.6-9.el7map	0:0.5.6-9.el7map
`radiusclient-ng-utils` Red Hat:mobile_application_platform:4.6	before 0:0.5.6-9.el7map	0:0.5.6-9.el7map
`redis` Red Hat:mobile_application_platform:4.6	before 0:2.8.21-2.el7map	0:2.8.21-2.el7map
`redis-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:2.8.21-2.el7map	0:2.8.21-2.el7map
`rhmap-fh-openshift-templates` Red Hat:mobile_application_platform:4.6	before 0:4.6.0-5.el7	0:4.6.0-5.el7
`rhmap-mod_authnz_external` Red Hat:mobile_application_platform:4.6	before 0:3.3.1-7.el7map	0:3.3.1-7.el7map
`rhmap-mod_authnz_external-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:3.3.1-7.el7map	0:3.3.1-7.el7map
`sendEmail` Red Hat:mobile_application_platform:4.6	before 0:1.56-2.el7	0:1.56-2.el7
`ssmtp` Red Hat:mobile_application_platform:4.6	before 0:2.64-14.el7map	0:2.64-14.el7map
`ssmtp-debuginfo` Red Hat:mobile_application_platform:4.6	before 0:2.64-14.el7map	0:2.64-14.el7map
`supervisor` Red Hat:mobile_application_platform:4.6	before 0:3.1.3-3.el7map	0:3.1.3-3.el7map
`node-tough-cookie` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.2+dfsg-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-15010 is a high vulnerability (CVSS 7.5) in Salesforce Tough-cookie, published October 3, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in tough-cookie 2.3.3.

References

Show 28 moreShow less