CVE-2026-111714

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...

EUVD-2026-103006

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...

CVE-2026-111714

The tarteaucitron.js library prior to version 1.37.0 is vulnerable to a Regular Expression Denial of Service (ReDoS) . The flaw exists in the cookie.purge function because it fails to handle unescaped cookie names correctly. An attacker can exploit this by planting a cookie from a sibling subdoma...

PT-2026-116113

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...