CVE-2026-22809 tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

What is CVE-2026-22809?

CVE-2026-22809 is a medium-severity denial of service vulnerability in AmauriC tarteaucitron.js, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

Weakness: CWE-1333

Which versions are affected by CVE-2026-22809?

2 open source packages ship an affected version, including tarteaucitronjs. It affects 1 product.

Products include Amauri Tarteaucitronjs.

How do I fix CVE-2026-22809?

Upgrade tarteaucitronjs to 1.29.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-22809 being exploited?

There is no known exploitation of CVE-2026-22809 in the wild and no public exploit code.

Other vulnerabilities in AmauriC tarteaucitron.js

• CVE-2025-31138 tarteaucitron.js allows UI manipulation via unrestricted CSS injection Medium 5.5
• CVE-2025-31475 tarteaucitron.js allows prototype pollution via custom text injection Medium 5.5
• CVE-2025-31476 tarteaucitron.js allows url scheme injection via unfiltered inputs Medium 4.8
• CVE-2025-48939 tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript Medium 4.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q5f6-qxm2-mcqm.