MGASA-2024-0080

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2023-26136
Published: 22 Mar 2024, 00:19
Last modified:16 Apr 2026, 04:23

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 Mar 2024, 00:19
Published
Vulnerability first disclosed
16 Apr 2026, 04:23
Last Modified
Vulnerability information updated

Description

Updated nodejs-tough-cookie packages fix security vulnerability Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized. (CVE-2023-26136)

Affected Systems

  • mageia•nodejs-tough-cookie

    < 2.3.4-5.1.mga9

References (3)