Executive brief
tarteaucitron.js is a JavaScript library used for managing cookie consent and tracking-related functionality on websites. An attacker who can control the issuu_id parameter can craft malicious input that triggers excessive backtracking in regular expressions, causing high CPU consumption and temporary service unavailability. This affects website availability but does not compromise data confidentiality or integrity.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in tarteaucitron.js caused by insufficiently constrained regular expressions applied to the issuu_id parameter. The vulnerable patterns use unanchored, greedy quantifiers (.*) that can cause catastrophic backtracking when evaluated against specially crafted input. An attacker with the ability to control the issuu_id parameter—typically through URL parameters or application configuration—can exploit this to exhaust CPU resources and degrade performance. The vulnerability was fixed in version 1.29.0 by anchoring the regular expressions, simplifying the matching logic, and enforcing strict input validation. The attack requires only local access (or application-level control of the parameter) and does not require authentication or user interaction.
Affected products
- tarteaucitron.js tarteaucitron.js <1.29.0
Timeline
- 2026-01-13: disclosed
- 2026-01-13: patched: Fix available in version 1.29.0 (commit f0bbdac)