Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111714tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

Low 3.1

In plain English

A low-severity regular-expression denial of service in tarteaucitron.js from AmauriC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.

Affected products (as reported)

Vendor	Product	Versions
AmauriC	tarteaucitron.js	0 – before 1.37.0

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

References

https://github.com/AmauriC/tarteaucitron.js/commit/60faaba5fd541cad770549d422fc4ac7de657e56 patch
tarteaucitron.js v1.37.0 Release Notes release-notes
https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2169-L2175 technical-description
VulnCheck Advisory: tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge third-party-advisory