tough-cookie (npm)
RFC6265 Cookies and CookieJar for Node.js
Advisories
3
Latest version
6.0.2
Released Jul 7, 2026
License
BSD-3-Clause
OpenSSF Scorecard
6.6 / 10
How to fix
Upgrading to 4.1.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install tough-cookie@6.0.2yarn
yarn add tough-cookie@6.0.2pnpm
pnpm add tough-cookie@6.0.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-72xf-g2v4-qvf3 tough-cookie Prototype Pollution vulnerability |
Critical EPSS 2.63% |
< 4.1.3 | 4.1.3 |
| GHSA-qhv9-728r-6jqg ReDoS via long string of semicolons in tough-cookie |
Medium EPSS 2.36% |
< 2.3.0 | 2.3.0 |
| GHSA-g7q5-pjjr-gqvp Regular Expression Denial of Service in tough-cookie |
High EPSS 3.28% |
< 2.3.3 | 2.3.3 |
Source: git://github.com/salesforce/tough-cookie.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor