CVE-2023-26136: Prototype Pollution vulnerability in tough-cookie
Summary
CVE-2023-26136: tough-cookie Prototype Pollution vulnerability. Affects tough-cookie versions < 4.1.3. Fixed in 4.1.3. How to fix ↓
Also tracked for
- node-tough-cookie · Debian:11
The same CVE-2023-26136 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tough-cookie is an npm package that provides a cookie management library for Node.js. It allows users to handle HTTP cookies, including parsing, serializing, and managing cookie jars. The package is widely used in web applications to manage session cookies and handle cookie-based authentication. However, versions before 4.1.3 are vulnerable to a Prototype Pollution issue when using the CookieJar in rejectPublicSuffixes=false mode. This vulnerability arises from improper handling of Cookies during object initialization.
Vulnerability Detail
The Prototype Pollution vulnerability in tough-cookie allows an attacker to modify the prototype of the Cookie object, leading to potential remote code execution or information disclosure. By manipulating the cookie values, an attacker can inject malicious code or modify existing properties, potentially compromising the security and integrity of the application. This vulnerability affects the tough-cookie.CookieJar.setCookieSync function.
How To Fix
Latest published version: 6.0.2 as of 22 Oct 2026
npm install tough-cookie@6.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.3
This is the first release that contains the fix.
npm install tough-cookie@4.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can set the rejectPublicSuffixes option to true when using the CookieJar. This mitigates the vulnerability by rejecting cookies with public suffixes. However, this workaround may impact the functionality of the application, as valid cookies with public suffixes will be rejected.
Conclusion
The Prototype Pollution vulnerability in tough-cookie can have serious security implications for applications using this package. It is crucial to upgrade to the latest version (4.1.3 or later) or apply the recommended workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tough-cookie →
FAQ
tough-cookie is an npm package that provides cookie management functionality for Node.js applications. It allows parsing, serializing, and managing HTTP cookies.
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to potential code execution or information disclosure.
This vulnerability in tough-cookie allows an attacker to manipulate the prototype of the Cookie object, potentially leading to remote code execution or information disclosure.
The impact of this vulnerability can vary depending on how the affected application uses the tough-cookie package. It could lead to remote code execution, data leakage, or unauthorized access to sensitive information.
To fix this vulnerability, update the tough-cookie package to version 4.1.3 or later. Update the package.json file and run the package manager's update command to install the updated package.
References
Related vulnerabilities
Recent vulnerabilities recorded for tough-cookie.
