CVE-2026-22809: medium-severity vulnerability in AmauriC tarteaucitron.js
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.4epss 0.1%
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
AmauriC · tarteaucitron.jsRelated CVEs — AmauriC tarteaucitron.js
In the same product, most dangerous first.
CVE-2025-31476MEDIUMtarteaucitron.js allows url scheme injection via unfiltered inputsEPSS 0.4%CVE-2026-49977MEDIUMtarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookiesEPSS 0.4%CVE-2025-31475MEDIUMtarteaucitron.js allows prototype pollution via custom text injectionEPSS 0.4%CVE-2025-31138MEDIUMtarteaucitron.js allows UI manipulation via unrestricted CSS injectionEPSS 0.3%CVE-2026-111714LOWtarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purgeEPSS 0.2%CVE-2025-48939MEDIUMtarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptEPSS 0.2%