CVE-2023-26136

Deeper analysis

Versions of the tough-cookie npm package before 4.1.3 are vulnerable to prototype pollution (CWE-1321) when a CookieJar is instantiated with rejectPublicSuffixes set to false. The flaw stems from unsafe object initialization during cookie handling, allowing attacker-controlled properties to pollute the prototype chain. The issue carries a CVSS 3.1 score of 6.5 with network attack vector, no required privileges or user interaction, and limited impacts on confidentiality and integrity.

An unauthenticated remote attacker can supply a crafted cookie that triggers the pollution when the vulnerable CookieJar configuration is used, enabling subsequent manipulation of application objects that inherit from the polluted prototype. This can lead to bypasses of security checks or unexpected behavior in any dependent code that relies on the affected cookie-parsing logic.

The referenced GitHub commit, release tag v4.1.3, and downstream advisories from Debian LTS and Fedora all direct users to upgrade to tough-cookie 4.1.3 or later to eliminate the unsafe initialization path. EPSS scores have remained low, with a current value of 0.0625 and a peak of only 0.0693.