Is CVE-2026-22809 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22809 being exploited in the wild.

How severe is CVE-2026-22809?

Low severity, with a CVSS score of 3.1, published 13 January 2026.

Which products and versions are affected?

tarteaucitronjs (npm) SEMVER:introduced=0,fixed=1.29.0.

Is there a fix for CVE-2026-22809?

Yes. tarteaucitronjs (npm): upgrade to 1.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22809 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-22809?

Check whether you run tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22809: tarteaucitron.js Regular Expression Denial of Service

CVE-2026-22809 · Severity: low · CVSS 3.1 · Published 2026-01-13

tarteaucitron.js is a JavaScript library used for managing cookie consent and tracking-related functionality on websites. An attacker who can control the issuu_id parameter can craft malicious input that triggers excessive backtracking in regular expressions, causing high CPU consumption and temporary service unavailability. This affects website availability but does not compromise data confidentiality or integrity.

Technologies: tarteaucitronjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-22809 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22809 being exploited in the wild.
How severe is CVE-2026-22809?: Low severity, with a CVSS score of 3.1, published 13 January 2026.
Which products and versions are affected?: tarteaucitronjs (npm) SEMVER:introduced=0,fixed=1.29.0.
Is there a fix for CVE-2026-22809?: Yes. tarteaucitronjs (npm): upgrade to 1.29.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22809 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-22809?: Check whether you run tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tarteaucitronjs (npm): upgrade to 1.29.0 or later
```
npm install tarteaucitronjs@1.29.0
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in tarteaucitron.js caused by insufficiently constrained regular expressions applied to the issuu_id parameter. The vulnerable patterns use unanchored, greedy quantifiers (.*) that can cause catastrophic backtracking when evaluated against specially crafted input. An attacker with the ability to control the issuu_id parameter—typically through URL parameters or application configuration—can exploit this to exhaust CPU resources and degrade performance. The vulnerability was fixed in version 1.29.0 by anchoring the regular expressions, simplifying the matching logic, and enforcing strict input validation. The attack requires only local access (or application-level control of the parameter) and does not require authentication or user interaction.

Affected products

tarteaucitron.js tarteaucitron.js <1.29.0

Identifiers

CVE-2026-22809
GHSA-q5f6-qxm2-mcqm

Timeline

2026-01-13: disclosed
2026-01-13: patched: Fix available in version 1.29.0 (commit f0bbdac)

References

https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q5f6-qxm2-mcqm

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.