4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22809

CVE-2026-22809: tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22809

CVE-2026-22809:

4.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tarteaucitronjs	npm	< 1.29.0	1.29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis identified two functions in tarteaucitron.services.js susceptible to Regular Expression Denial of Service (ReDoS). The primary vulnerability, rated with high confidence, exists in tarteaucitron.services.issuu.js. This function used the regex /d=(.*)&u=(.*)/ to parse the issuu_id. The greedy .* quantifiers in this expression create an opportunity for catastrophic backtracking when processing malicious input, leading to CPU exhaustion. The patch mitigates this by removing the complex regex and simplifying the logic. A secondary ReDoS vulnerability was found in tarteaucitron.services.alexa.js, which used the regex /[^.]*.[^.]*$/ on the hostname. This regex is also inefficient and could be exploited, though it is considered less severe. The patch completely removes the alexa service, which was deprecated, thus eliminating this vulnerability as well. The analysis of the commit patch clearly shows the removal and modification of these vulnerable parts.

Vulnerable functions

tarteaucitron.services.issuu.js

tarteaucitron.services.js

The function uses a regular expression `d=(.*)&u=(.*)` that is vulnerable to Regular Expression Denial of Service (ReDoS). When matching against a crafted string, the `.*` patterns can cause excessive backtracking, leading to high CPU consumption and denial of service. The vulnerable code is executed when handling the `issuu_id` parameter.

tarteaucitron.services.alexa.js

tarteaucitron.services.js

The function uses the regular expression `/[^.]*.[^.]*$/` on `window.location.hostname`. The unescaped dot `.` combined with `[^.]*` can lead to excessive backtracking on specially crafted hostnames, causing a Regular Expression Denial of Service (ReDoS). This entire service was removed as part of the fix.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.