Skip to content
Fencer Vulns
medium 6.5

CVE-2023-26136 json

tough-cookie Prototype Pollution vulnerability

published 2023-07-01 3 y ago modified 2026-09-10 1 mo ago also GHSA-72xf-g2v4-qvf3 , EUVD-2023-1983

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Patch / fix

  • npm tough-cookie 4.1.3
  • n/a tough-cookie 4.1.3
  • node-tough-cookie Debian 12 4.0.0-2+deb12u1
  • node-tough-cookie Debian 14, Debian 13 4.1.3+~4.0.2-1

debian advisories DEBIAN-CVE-2023-26136

  • eap7-netty jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.13-8.GA_redhat_00001.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.4 3.15.8-1.Final_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.26-1.SP1_redhat_00001.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.4 5.3.31-1.Final_redhat_00001.1.el8eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.19-1.Final_redhat_00001.1.el8eap
  • eap7-ironjacamar jboss enterprise application platform 7.4 1.5.15-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2023:5485RHSA-2023:5486RHSA-2023:5484

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-26136 updated cvss 6.5

tough-cookie: prototype pollution in cookie memstore

  • Red Hat Migration Toolkit for Applications 6 mta/mta-ui-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Runtimes tough-cookie
    affected: no fix available
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8
    affected: no fix available
  • Red Hat OpenShift Serverless tough-cookie
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8, rhacm2/search-api-rhel8, acm-cluster-templates-console-plugin-container
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 tough-cookie
    affected: no fix available
  • Red Hat Ceph Storage 4 cockpit-ceph-installer Red Hat Certification for Red Hat Enterprise Linux 7 redhat-certification
    affected: no fix planned “Out of support scope”
show 29 more
  • Red Hat Data Grid 8 tough-cookie
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 tough-cookie
    affected: no fix planned “Out of support scope”
  • Red Hat Discovery 1 discovery-server-container
    affected: no fix planned “Will not fix”
  • Red Hat Fuse 7 tough-cookie
    affected: no fix planned “Out of support scope”
  • Red Hat Integration Camel K 1 tough-cookie Red Hat JBoss Data Grid 7 tough-cookie
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack tough-cookie
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/nmstate-console-plugin-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8
    affected: no fix available
  • Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8, noobaa-core-container, odf4/odf-console-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8
    affected: no fix available
  • Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces-theia-rhel8-container
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-collector-rhel8
    affected: no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argo-rollouts-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9
    affected: no fix available
  • Red Hat Process Automation 7 tough-cookie
    affected: no fix planned “Out of support scope”
  • Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
    affected: no fix planned “Will not fix”
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el7eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el7eap, +95 more
    fixed: vendor fix RHSA-2023:5484
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el8eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el8eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el8eap, +96 more
    fixed: vendor fix RHSA-2023:5485
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el9eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el9eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el9eap, +93 more
    fixed: vendor fix RHSA-2023:5486
  • Red Hat JBoss Enterprise Application Platform hal-console 3.3.19.Final-redhat-00001
    fixed: vendor fix RHSA-2023:5488
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 v1.8.2-2
    fixed: vendor fix RHSA-2023:7222
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-monitoring-plugin-rhel8 v4.14.0-202310201027.p0.g8757197.assembly.stream
    fixed: vendor fix RHSA-2023:5006
  • Red Hat RHODF 4.14 for RHEL 9 odf4/odf-multicluster-console-rhel9 v4.14.13-3
    fixed: vendor fix RHSA-2025:0323
  • Red Hat RHODF 4.15 for RHEL 9 odf4/odf-multicluster-console-rhel9 v4.15.9-1
    fixed: vendor fix RHSA-2025:0164
  • Red Hat RHODF 4.16 for RHEL 9 odf4/odf-multicluster-console-rhel9 v4.16.5-2
    fixed: vendor fix RHSA-2025:0082
  • Red Hat RHODF 4.17 for RHEL 9 odf4/odf-multicluster-console-rhel9 v4.17.0-53
    fixed: vendor fix RHSA-2024:8676
  • Red Hat RHOL 5.5 for RHEL 8 openshift-logging/logging-view-plugin-rhel8 v5.5.17-6
    fixed: vendor fix RHSA-2023:5542
  • Red Hat RHOL 5.6 for RHEL 8 openshift-logging/logging-view-plugin-rhel8 v5.6.12-8
    fixed: vendor fix RHSA-2023:5541

1 more fixed, 28 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-200-02 updated cvss 6.5

Subnet Solutions PowerSYSTEM Center

  • Subnet Solutions Inc. PowerSYSTEM Center 2020 <=Update_20
    affected: mitigation “Subnet Solutions recommends users upgrade to PowerSYSTEM Center versions 2020 Update 21 or later. To obtain this software, contact Subnet Solution's Customer Service.” subnet.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

2.63% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • security.snyk.io https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/salesforce/tough-cookie/issues/282 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm tough-cookie
<4.1.3
4.1.3

Affected products

  • n/a tough-cookie

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.