npm package
tough-cookie vulnerabilities by version
The latest release, 6.0.2 (Jul 7, 2026), has no known vulnerabilities. 12% of last week’s 141.2M downloads went to versions with known vulnerabilities. OSV.dev lists 3 advisories for tough-cookie; the newest was published on Jul 1, 2023.
npm (opens in a new tab) describes it as “RFC6265 Cookies and Cookie Jar for node.js”
- Latest release
- 6.0.2
- Jul 7, 2026, no known vulnerabilities
- Downloads last week
- 141.2M
- All versions, from npm
- Advisories on OSV.dev
- 3
- Newest Jul 1, 2023
- Licence
- BSD-3-Clause
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable tough-cookie
12% of last week’s 141.2M tough-cookie downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. tough-cookie doesn’t publish support dates we can check.
Newest advisories
The 3 most recently published, with the versions each one affects.
WarningCVE-2023-26136 on OSV.dev (opens in a new tab)GHSA-72xf-g2v4-qvf3
tough-cookie Prototype Pollution vulnerability
Affects < 4.1.3. Published Jul 1, 2023.
WarningCVE-2016-1000232 on OSV.dev (opens in a new tab)GHSA-qhv9-728r-6jqg
ReDoS via long string of semicolons in tough-cookie
Affects < 2.3.0. Published Oct 10, 2018.
CriticalCVE-2017-15010 on OSV.dev (opens in a new tab)GHSA-g7q5-pjjr-gqvp
Regular Expression Denial of Service in tough-cookie
Affects < 2.3.3. Published Jul 24, 2018.
Which tough-cookie do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for tough-cookie, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.