tarteaucitron.js CVE-2026-111714

Exploitation requires that the attacker can control the cookie name read by tarteaucitron's cookie.purge routine - specifically either (a) the ability to set a cookie on a sibling subdomain sharing the victim's parent domain, or (b) the ability to inject a purgeBtn DOM element carrying a crafted data-cookie attribute containing a catastrophic-backtracking pattern. Exploitation is further gated by mandatory user interaction: the victim must actually click the purge button to trigger the vulnerable regex (UI:P). Limiting factors are significant - high attack complexity (AC:H), a required attack condition (AT:P), dependence on the victim performing the purge action, and the fact that impact is confined to freezing the client-side page (availability only, VA:L); there is no server-side, confidentiality, or integrity impact.

This is a low-priority issue despite being a network-reachable vulnerability. The vendor-assigned CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VA:L only) yields a score of just 2.3, and every signal corroborates low real-world risk. The attack requires high complexity (AC:H), a specific attack condition (AT:P), and active user interaction (UI:P - the victim must click the purge button), while the only impact is limited availability (VA:L) - a frozen browser tab, not server-side DoS, data exposure, or code execution. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was identified in the supplied intelligence, so there is no evidence of active exploitation; this is a client-side availability nuisance rather than a widespread threat. The source-code evidence confirms the root cause and the fix: the pre-1.37.0 regex concatenated the raw cookie name into a RegExp, and the patch (commit 60faaba) escapes regex metacharacters, consistent with a genuine CWE-1333 catastrophic-backtracking ReDoS. Verdict: a real but very low-severity, self-inflicted/targeted client-side DoS - remediate via routine dependency update, not emergency patching.

An attacker who controls a sibling subdomain (or who can inject a purgeBtn element with a crafted data-cookie attribute into the page) plants a cookie whose name contains a catastrophic-backtracking pattern. When the victim clicks the cookie purge button, tarteaucitron.js builds an unescaped regular expression from that name, and the resulting exponential backtracking freezes the browser tab. No public exploit was identified in the provided data, though the vendor commit diff clearly demonstrates the vulnerable regex construction.