CVE-2026-111714: Inefficient Regular Expression Complexity in AmauriC tarteaucitron.js

CVE-2026-111714 is a ReDoS vulnerability in AmauriC's tarteaucitron.js prior to version 1.37.0. The vulnerability arises from inefficient regular expression handling in the cookie.purge function. Attackers can exploit this by providing unescaped cookie names, either via cookies set on sibling subdomains or by injecting a purgeBtn element with a crafted data-cookie attribute. When the purge button is activated, the vulnerable regular expression undergoes catastrophic backtracking, freezing the page and causing a denial of service.

Successful exploitation results in a denial of service condition by freezing the visitor's page when the purge button is clicked. This can disrupt user experience but does not escalate to privilege or data compromise. The CVSS 4.0 score of 2.3 indicates low severity with network attack vector, high attack complexity, and requiring user interaction.

A fix is available in tarteaucitron.js version 1.37.0 and later. Users should upgrade to version 1.37.0 or newer to remediate this vulnerability. Until then, avoid using untrusted cookie names with the cookie.purge function and restrict the ability to inject purgeBtn elements with arbitrary data-cookie attributes.