Live › vulnerability › CVE-2026-111714
Go to dashboardtarteaucitron.js before 1.37.0 builds a regular expression from unescaped cookie names passed to cookie.purge. A cookie planted from a sibling subdomain or a crafted purgeBtn data-cookie value can cause catastrophic backtracking, freezing the page when the purge button is clicked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that load tarteaucitron.js below 1.37.0 on pages that run its cookie purge feature. Exposure depends on whether an attacker can set cookies on a sibling subdomain or inject markup into a purge button. Sites on a current version can skip this.
No product ranges from the sources yet.
grep -i version node_modules/tarteaucitron/package.json1.37.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
This page as .md · .json · in your agent: get_signal("CVE-2026-111714")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.