Skip to content

Regular Expression Denial of Service in tough-cookie

High severity GitHub Reviewed Published Jul 24, 2018 to the GitHub Advisory Database • Updated Nov 29, 2023

Package

npm tough-cookie (npm)

Affected versions

< 2.3.3

Patched versions

2.3.3

Description

Affected versions of tough-cookie are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

If node was compiled using the -DHTTP_MAX_HEADER_SIZE however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.

Recommendation

Update to version 2.3.3 or later.

References

Published to the GitHub Advisory Database Jul 24, 2018
Reviewed Jun 16, 2020
Last updated Nov 29, 2023

Severity

High
7.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CVE ID

CVE-2017-15010

GHSA ID

GHSA-g7q5-pjjr-gqvp

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.