CVE-2016-1000232
ReDoS via long string of semicolons in tough-cookie
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
- Record
CVE-2016-1000232- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
- Record
CVE-2016-1000232- Updated
- 2026-11-02
EUVDEUVD-2018-0666 No score
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
- Record
EUVD-2018-0666- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qhv9-728r-6jqg
ReDoS via long string of semicolons in tough-cookie
Affected versions of tough-cookie may be vulnerable to regular expression denial of service when long strings of semicolons exist in the Set-Cookie header.
Recommendation
Update to version 2.3.0 or later.
- Record
GHSA-qhv9-728r-6jqg- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
- Record
CVE-2016-1000232- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-qhv9-728r-6jqg
ReDoS via long string of semicolons in tough-cookie
Affected versions of tough-cookie may be vulnerable to regular expression denial of service when long strings of semicolons exist in the Set-Cookie header.
Recommendation
Update to version 2.3.0 or later.
- Record
GHSA-qhv9-728r-6jqg- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333
- Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2016:2101
Red Hat Security Advisory: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update
- Record
RHSA-2016:2101- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2017:2912
Red Hat Security Advisory: rh-nodejs4-nodejs-tough-cookie security update
- Record
RHSA-2017:2912- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1772583199 No score
TuxCare security update for tough-cookie (3 CVEs)
TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 0.12.1-tuxcare.1.
- Record
CLSA-2026-1772583199- Updated
- 2026-11-02
OSVCLSA-2026-1773101696 No score
TuxCare security update for tough-cookie (3 CVEs)
TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 2.2.0-tuxcare.1.
- Record
CLSA-2026-1773101696- Updated
- 2026-11-02
OSVCLSA-2026-1774225211 No score
TuxCare security update for tough-cookie (3 CVEs)
TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 1.2.0-tuxcare.1.
- Record
CLSA-2026-1774225211- Updated
- 2026-11-02
OSVCLSA-2026-1784596295 No score
TuxCare security update for tough-cookie (1 CVE)
TuxCare rebuilt tough-cookie to address 1 CVE. Fixed in 2.2.2-tuxcare.2.
- Record
CLSA-2026-1784596295- Updated
- 2026-11-02
OSVCLSA-2026-1792164090 No score
TuxCare security update for tough-cookie (3 CVEs)
TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 2.2.1-tuxcare.1.
- Record
CLSA-2026-1792164090- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tough-cookienpm |
before 2.3.0 | 2.3.0 |
tough-cookieTuxCare:npm |
0.12.1-tuxcare.0 up to 0.12.1-tuxcare.1, plus listed versions 0.12.1 |
0.12.1-tuxcare.1 |
tough-cookieTuxCare:npm |
2.2.0-tuxcare.0 up to 2.2.0-tuxcare.1, plus listed versions 2.2.0 |
2.2.0-tuxcare.1 |
tough-cookieTuxCare:npm |
1.2.0-tuxcare.0 up to 1.2.0-tuxcare.1, plus listed versions 1.2.0 |
1.2.0-tuxcare.1 |
tough-cookieTuxCare:npm |
2.2.2-tuxcare.0 up to 2.2.2-tuxcare.2, plus listed versions 2.2.22.2.2-tuxcare.1 |
2.2.2-tuxcare.2 |
tough-cookieTuxCare:npm |
2.2.1-tuxcare.0 up to 2.2.1-tuxcare.1, plus listed versions 2.2.1 |
2.2.1-tuxcare.1 |
nodejsRed Hat:openshift:3.1::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-debuginfoRed Hat:openshift:3.1::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-develRed Hat:openshift:3.1::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-docsRed Hat:openshift:3.1::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nodejs-tough-cookieRed Hat:openshift:3.1::el7 |
before 0:2.3.1-1.el7 | 0:2.3.1-1.el7 |
nodejsRed Hat:openshift:3.2::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-debuginfoRed Hat:openshift:3.2::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-develRed Hat:openshift:3.2::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-docsRed Hat:openshift:3.2::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-tough-cookieRed Hat:openshift:3.2::el7 |
before 0:2.3.1-1.el7 | 0:2.3.1-1.el7 |
nodejsRed Hat:openshift:3.3::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-debuginfoRed Hat:openshift:3.3::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-develRed Hat:openshift:3.3::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-docsRed Hat:openshift:3.3::el7 |
before 0:0.10.47-2.el7 | 0:0.10.47-2.el7 |
nodejs-tough-cookieRed Hat:openshift:3.3::el7 |
before 0:2.3.1-1.el7 | 0:2.3.1-1.el7 |
rh-nodejs4-nodejs-tough-cookieRed Hat:rhel_software_collections:2::el6 |
before 0:2.3.3-2.el6 | 0:2.3.3-2.el6 |
rh-nodejs4-nodejs-tough-cookieRed Hat:rhel_software_collections:2::el7 |
before 0:2.3.3-2.el7 | 0:2.3.3-2.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1000232 is a medium vulnerability (CVSS 5.3) in Salesforce Tough-cookie, published September 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.36%, the 83rd percentile. Fixed in tough-cookie 2.3.0.
References
access.redhat.com/errata/RHSA-2016:2101
ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232
npmjs.com/advisories/130
github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-1000232
bugzilla.redhat.com/show_bug.cgi?id=1346910
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2101.json
cve.org/CVERecord?id=CVE-2016-5325
nodejs.org/en/blog/vulnerability/september-2016-security-releases
nodesecurity.io/advisories/130