The Infinite Loop in Your Cookie Jar: Analyzing CVE-2026-22809
Jan 14, 2026·6 min read·3 visits
Executive Summary (TL;DR)
Tarteaucitron.js < 1.29.0 contains a ReDoS vulnerability in its Issuu service integration. A greedy regex pattern `/d=(.*)&u=(.*)/` allows attackers to trigger exponential processing time via crafted inputs, causing a Denial of Service. The fix involves anchoring the regex and removing the greedy capture groups, though the remediation strategy introduces a potential secondary XSS risk.
A deep dive into a Regular Expression Denial of Service (ReDoS) vulnerability in tarteaucitron.js, a popular cookie consent manager. The flaw allows malicious configuration strings to trigger catastrophic backtracking, potentially freezing the end-user's browser.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
tarteaucitron.js AmauriC | < 1.29.0 | 1.29.0 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-1333 (ReDoS) |
| CVSS v3.1 | 4.4 (Medium) |
| Attack Vector | Local / Config-based |
| Impact | High Availability (Browser Hang) |
| Exploit Status | PoC Available |
| Patch Commit | f0bbdac2fdf3cd24a325fc0928c0d34abf1b7b52 |
MITRE ATT&CK Mapping
The software uses a regular expression that can be made to process input in exponential time, leading to a denial of service.