CVE-2026-111714
LowCVSS 3.1Summary
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Risk Assessment
Site visitors may experience browser freezing after clicking the cookie purge button, resulting in client-side denial of service. This can be exploited to block access to the website.
Recommendation
Upgrade tarteaucitron.js to version 1.37.0 or later. Until then, consider disabling the cookie.purge feature.
Other vulnerabilities in tarteaucitron.js
See all- CVE-2026-111713Medium
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
- CVE-2026-49977Medium
Vulnerability in tarteaucitron.js before version 1.33.0. The tarteaucitron.cookie.purge() function is called on any element with the purgeBtn class without checking if it is a legitimate tarteaucitron button. An attacker can delete a non-HttpOnly cookie with a known name via user click.
Original NVD description (English source)
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS