CVE-2017-15010

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/101185Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2912Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2913Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1263Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1264Third Party Advisory
https://github.com/salesforce/tough-cookie/issues/92Issue Tracking, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
https://nodesecurity.io/advisories/525Third Party Advisory
https://snyk.io/vuln/npm:tough-cookie:20170905Patch, Third Party Advisory
http://www.securityfocus.com/bid/101185Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:2912Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2913Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1263Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1264Third Party Advisory
https://github.com/salesforce/tough-cookie/issues/92Issue Tracking, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
https://nodesecurity.io/advisories/525Third Party Advisory
https://snyk.io/vuln/npm:tough-cookie:20170905Patch, Third Party Advisory

Timeline

Published: Oct 4, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-150117.5The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers CVE-2017-150128.8OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUT_FILE CVE-2017-150138.8OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an a CVE-2017-150144.3OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows auth CVE-2017-150158.8ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.CVE-2017-150168.8ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.CVE-2017-150178.8ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.CVE-2017-150185.5LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file CVE-2017-150197.8LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, be CVE-2017-15025.4IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra CVE-2017-150207.8dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows re CVE-2017-150215.5bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows