CVE-2023-26136 Overview
CVE-2023-26136 is a prototype pollution vulnerability in the tough-cookie Node.js package, maintained by Salesforce. Versions prior to 4.1.3 mishandle cookie objects when CookieJar is used in rejectPublicSuffixes=false mode. The flaw stems from how the package initializes internal objects, allowing attackers to inject properties into Object.prototype through crafted cookie data.
The tough-cookie library is widely embedded in HTTP clients and automation tooling across the Node.js ecosystem, expanding the attack surface to any application that parses untrusted cookies with the vulnerable configuration. The issue is tracked under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes).
Critical Impact
Successful exploitation enables prototype pollution that can lead to denial of service, authentication bypass, or remote code execution depending on downstream usage of polluted properties.
Affected Products
- Salesforce tough-cookie versions before 4.1.3
- Node.js applications using CookieJar with rejectPublicSuffixes=false
- Downstream distributions including Debian LTS, Fedora, and NetApp products bundling the vulnerable package
Discovery Timeline
- 2023-07-01 - CVE-2023-26136 published to the National Vulnerability Database (NVD)
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-26136
Vulnerability Analysis
The vulnerability resides in how tough-cookie constructs internal storage objects when handling cookies. When CookieJar operates in rejectPublicSuffixes=false mode, the library initializes objects without a null prototype. Attackers can supply cookie keys such as __proto__ or constructor.prototype that traverse the prototype chain and modify Object.prototype globally.
Once Object.prototype is polluted, every object in the JavaScript runtime inherits the attacker-controlled property. Downstream code that checks object properties for authorization, configuration, or template rendering may consume the injected value, producing unexpected behavior across the application.
Root Cause
The root cause is improper initialization of cookie storage objects. The library used plain JavaScript objects rather than Object.create(null) or a Map, leaving the prototype chain reachable from user-controlled keys. Combined with rejectPublicSuffixes=false, the parser accepted cookie domains that would normally be filtered, exposing the unsafe key assignment path.
Attack Vector
Exploitation occurs over the network and requires no authentication or user interaction. An attacker controls a server response containing crafted Set-Cookie headers, or supplies cookie strings to a Node.js application that uses tough-cookie with the vulnerable configuration. When the application parses the cookies, the malicious keys mutate the global prototype.
No verified public proof-of-concept code is available. For technical specifics, see the GitHub Issue Discussion, the Snyk Vulnerability Report, and the upstream fix commit.
Detection Methods for CVE-2023-26136
Indicators of Compromise
- Unexpected properties appearing on generic objects at runtime, particularly properties that were never explicitly assigned by application code
- HTTP responses or cookie strings containing __proto__, constructor, or prototype tokens in cookie names or domain fields
- Application errors referencing unexpected inherited properties during JSON serialization or template rendering
Detection Strategies
- Inventory Node.js projects using Software Composition Analysis (SCA) tooling to identify tough-cookie versions below 4.1.3 in direct and transitive dependencies
- Inspect application code for CookieJar instantiations that pass rejectPublicSuffixes: false and flag them for review
- Monitor outbound HTTP client traffic for Set-Cookie headers containing prototype-related keywords
Monitoring Recommendations
- Enable runtime application self-protection or Node.js process telemetry that records anomalous property writes to Object.prototype
- Forward dependency audit results from npm audit or equivalent scanners into a central SIEM for tracking
- Alert on changes to cookie-handling middleware configurations in source control
How to Mitigate CVE-2023-26136
Immediate Actions Required
- Upgrade tough-cookie to version 4.1.3 or later across all direct and transitive dependencies
- Audit applications for CookieJar instances configured with rejectPublicSuffixes=false and revert to the default where feasible
- Rebuild and redeploy container images and serverless bundles that include the vulnerable package
Patch Information
The fix landed in commit 12d47479 and is released in tough-cookie v4.1.3. Distribution updates are available through the Debian LTS Announcement, Fedora Package Announcement, and the NetApp Security Advisory.
Workarounds
- Avoid setting rejectPublicSuffixes=false unless explicitly required by application logic
- Sanitize cookie input by rejecting keys matching __proto__, constructor, or prototype before passing them to the cookie jar
- Freeze Object.prototype at process startup using Object.freeze(Object.prototype) to block runtime mutation
# Configuration example
npm install tough-cookie@^4.1.3
npm ls tough-cookie
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
