What is the CVSS score of CVE-2026-22809?

CVE-2026-22809 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tarteaucitronjs are affected by CVE-2026-22809?

Organizations using tarteaucitron.js should be aware of moderate risk from CVE-2026-22809 rated CVSS 4.4. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-22809?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Tarteaucitronjs CVE-2026-22809

MEDIUM

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-01-13 security-advisories@github.com

GHSA-q5f6-qxm2-mcqm

Denial Of Service Tarteaucitronjs

4.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 20, 2026 - 16:49 nvd

Patch available

CVE Published

Jan 13, 2026 - 20:16 nvd

MEDIUM 4.4

DescriptionGitHub Advisory

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

AnalysisAI

Tarteaucitronjs versions up to 1.29.0 is affected by inefficient regular expression complexity (redos) (CVSS 4.4).

Technical ContextAI

This vulnerability (CWE-1333: Inefficient Regular Expression Complexity (ReDoS)) exists in the handling of the issuu_id component. tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.