CVE-2026-111714

tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

2.3 Low

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.22%Unchanged since Oct 17, 2026

What each source reports

CVE List Score used 2.3

tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

Record: CVE-2026-111714
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

EUVDEUVD-2026-103006 2.3

Record: EUVD-2026-103006
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h33v-xq5w-v2mw 2.3

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that...

Record: GHSA-h33v-xq5w-v2mw
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

NVD 2.3

Record: CVE-2026-111714
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

OSV 2.3

tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

Record: CVE-2026-111714
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness: CWE-1333
Updated: 2026-11-02

Affected products

amauric tarteaucitron.js

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-111714 is a low vulnerability (CVSS 2.3) in Amauric Tarteaucitron.js, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.