CVE-2017-15010: Regular Expression Denial of Service in tough-cookie
Summary
CVE-2017-15010: Regular Expression Denial of Service in tough-cookie. Affects tough-cookie versions < 2.3.3. Fixed in 2.3.3. How to fix ↓
Also tracked for
- node-tough-cookie · Debian:11
The same CVE-2017-15010 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tough-cookie package is an npm package that provides a cookie parser and serializer for HTTP requests and responses. It is commonly used in Node.js applications to handle cookies. The package allows developers to parse and serialize cookies according to the HTTP state management mechanism defined in RFC 6265. However, certain versions of tough-cookie are vulnerable to a regular expression denial of service (ReDoS) attack.
Vulnerability Detail
The vulnerability in tough-cookie arises from a regular expression used in the tough-cookie.Cookie.parse function. An attacker can exploit this vulnerability by providing a malicious input that triggers a ReDoS attack. The impact of the vulnerability is relatively low, as it takes around 2 seconds for the engine to execute on a malicious input of 50,000 characters. However, if Node.js was compiled using the -DHTTP_MAX_HEADER_SIZE flag, the vulnerability can have a significant impact, as the default max HTTP header length in Node.js becomes the primary limitation. This can lead to denial of service or other potential security issues.
How To Fix
Latest published version: 6.0.2 as of 22 Oct 2026
npm install tough-cookie@6.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.3
This is the first release that contains the fix.
npm install tough-cookie@2.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update to the latest version of the tough-cookie package.
Conclusion
The tough-cookie package is vulnerable to a regular expression denial of service (ReDoS) attack. It is recommended to update to version 2.3.3 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com. Vulert's playground (https://vulert.com/scanner) can also be used to check if your application is affected by this vulnerability.
See every vulnerability recorded for tough-cookie →
FAQ
The impact of this vulnerability is relatively low, but if Node.js was compiled using the -DHTTP_MAX_HEADER_SIZE flag, the vulnerability can have a significant impact, potentially leading to denial of service or other security issues.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
A regular expression denial of service (ReDoS) attack is a type of denial of service attack that exploits the exponential time complexity of certain regular expressions. By providing a specially crafted input, an attacker can cause the regular expression engine to spend an excessive amount of time matching the input, leading to a significant impact on performance or even a complete denial of service.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
There are no known public exploits for this vulnerability at the time of writing. However, it is always recommended to update to the latest version of the affected package to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for tough-cookie.
