GHSA-72xf-g2v4-qvf3 CVE-2023-26136

tough-cookie Prototype Pollution vulnerability

Critical npm

Severity: 6.5 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 2.63%; Chance of exploitation in the next 30 days. Higher than 85.50% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Fix: 4.1.3; Upgrade tough-cookie to this version or later

Description

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Affected versions

npm

Package	Vulnerable	Fixed in
tough-cookie	`< 4.1.3`	`4.1.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

tough-cookie npm → `4.1.3`

npm

npm install tough-cookie@4.1.3

yarn

yarn add tough-cookie@4.1.3

pnpm

pnpm add tough-cookie@4.1.3

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Weakness

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

How to prevent it

Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Implementation: When handling untrusted objects, validating using a schema can be used.
Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2023-26136

Packages

github.com/salesforce/tough-cookie

Timeline

Jul 1, 2023 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-qhv9-728r-6jqg ReDoS via long string of semicolons in tough-cookie	Medium	Also affects tough-cookie
GHSA-g7q5-pjjr-gqvp Regular Expression Denial of Service in tough-cookie	High	Also affects tough-cookie
GHSA-6wvx-3r32-xmcg Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie	Medium	Same weakness, CWE-1321
GHSA-7648-jmwf-vw7j systeminformation has prototype pollution in `networkStats()` via the interface name	Medium	Same weakness, CWE-1321
GHSA-m2m5-rw3w-cwmj ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users	Medium	Same weakness, CWE-1321
GHSA-j5rq-xfvr-p969 ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service	High	Same weakness, CWE-1321
GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register	High	Same weakness, CWE-1321
GHSA-4q55-j62x-fr9h devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion	Medium	Same weakness, CWE-1321

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor