CVE-2026-22809: tarteaucitron.js Regular Expression Denial of Service Vulnerability
Summary
CVE-2026-22809: tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability. Affects tarteaucitronjs versions < 1.29.0. Fixed in 1.29.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
tarteaucitron.js is a JavaScript library designed to manage user consent for cookies and trackers in compliance with GDPR regulations. It provides a user-friendly interface for website owners to ensure that they are handling user data responsibly. However, the library has been found to contain a vulnerability that can be exploited through the 'issuu_id' parameter, potentially leading to service degradation.
Vulnerability Detail
A Regular Expression Denial of Service (ReDoS) vulnerability exists in tarteaucitron.js due to insufficiently constrained regular expressions used to validate the 'issuu_id' parameter. The vulnerability arises from the use of greedy patterns and unanchored expressions, which can lead to excessive backtracking when processing specially crafted input. An attacker can exploit this vulnerability to cause high CPU consumption, resulting in performance degradation or temporary service unavailability. No confidentiality or integrity impacts have been identified.
How To Fix
Minimum fixed version
1.29.0
This is the first release that contains the fix.
npm install tarteaucitronjs@1.29.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, you can implement input validation to ensure that the 'issuu_id' parameter adheres to expected formats. For example, you can use the following code snippet to validate the input before processing it:
if (issuu_id.match(/^\d+\/\d+$/)) {
issuu_embed = '#' + issuu_id;
} else {
issuu_embed = '?' + issuu_id;
}
Conclusion
The vulnerability identified in tarteaucitron.js poses a risk of denial of service through the exploitation of regular expressions. It is crucial to update to the patched version to mitigate this risk. Users should also consider implementing input validation as a temporary measure until they can update the package.
See every vulnerability recorded for tarteaucitronjs →
FAQ
A ReDoS vulnerability occurs when an application uses regular expressions that can be exploited by attackers to cause excessive backtracking, leading to high CPU usage and potential denial of service.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
If exploited, this vulnerability can lead to performance degradation or temporary unavailability of the service, affecting user experience.
No, this vulnerability does not impact data confidentiality or integrity; it primarily affects service availability.
Implement input validation for the 'issuu_id' parameter to ensure it matches expected formats, as shown in the provided workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for tarteaucitronjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
