# CVE-2023-26136: tough-cookie Prototype Pollution in object initialization

Source: https://junglewise.ai/threats/cve-2023-26136-tough-cookie-prototype-pollution-in-object-initialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-26136 · Severity: low · CVSS 3.1 · Published 2023-07-01

tough-cookie is a widely-used JavaScript library for parsing and managing HTTP cookies. A prototype pollution vulnerability allows attackers to poison the global Object prototype by crafting malicious cookies with `Domain=__proto__`, potentially affecting all JavaScript objects in an application and leading to unexpected behavior or security bypasses.

Technologies: [tough-cookie (npm)](https://junglewise.ai/threats/technologies/tough-cookie). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-26136 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26136 being exploited in the wild.

**How severe is CVE-2023-26136?** Low severity, with a CVSS score of 3.1, published 1 July 2023.

**Which products and versions are affected?** tough-cookie (npm) SEMVER:introduced=0,fixed=4.1.3.

**Is there a fix for CVE-2023-26136?** Yes. tough-cookie (npm): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26136 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-26136?** Check whether you run tough-cookie (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tough-cookie (npm): upgrade to 4.1.3 or later

  ```sh
  npm install tough-cookie@4.1.3
  ```


## Technical details

The vulnerability is a prototype pollution issue (CWE-1321) in the MemoryCookieStore of tough-cookie versions before 4.1.3. The root cause is improper object initialization: the code uses `this.idx = {}` as a plain object and stores cookies keyed by `cookie.domain` without sanitizing special properties like `__proto__`. When an attacker provides a cookie with `Domain=__proto__`, the assignment `this.idx[cookie.domain][cookie.path][cookie.key] = cookie` pollutes the Object prototype. This only occurs when CookieJar is instantiated with `rejectPublicSuffixes=false`. The attack requires no authentication or user interaction—an attacker simply needs to trigger cookie storage via the setCookie() method. Exploitation can corrupt the prototype chain, affecting all objects in the application. A patch was released in version 4.1.3; the fix likely uses `Object.create(null)` or a Map to avoid prototype pollution.

## Affected products

- Salesforce tough-cookie before 4.1.3

## Identifiers

- CVE-2023-26136
- GHSA-72xf-g2v4-qvf3

## Timeline

- 2023-06-02: disclosed
- 2023-07-01: advisory
- 2023-07-01: patched: version 4.1.3 released

## References

- [https://github.com/salesforce/tough-cookie/issues/282](https://github.com/salesforce/tough-cookie/issues/282)

## Related threats

- [tough-cookie ReDoS via semicolon strings](https://junglewise.ai/threats/cve-2016-1000232-tough-cookie-redos-via-semicolon-strings)
- [tough-cookie regular expression denial of service](https://junglewise.ai/threats/cve-2017-15010-tough-cookie-regular-expression-denial-of-service)