Medium
Security advisory
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-1000232
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 09:38 UTC · Revision 1
Source evidence
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
osv:CVE-2016-1000232
Complete source record
{
"id": "59f79c0cb4dd75132e79db883a4585060783da21c95d6c90e8acbeda10867149",
"url": "https://osv.dev/vulnerability/CVE-2016-1000232",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-1000232",
"summary": "NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.",
"evidence": "osv:CVE-2016-1000232",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2016-1000232",
"aliases": [
"CVE-2016-1000232",
"GHSA-qhv9-728r-6jqg"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/salesforce/tough-cookie",
"type": "GIT",
"events": [
{
"introduced": "8292403cfbea01d331d5ea1bdb2107c3cb110d6d"
},
{
"last_affected": "cc46628c4d7d2e8c372ecba29293ca8a207ec192"
},
{
"fixed": "615627206357d997d5e6ff9da158997de05235ae"
},
{
"fixed": "e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:salesforce:tough-cookie:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0.9.7"
},
{
"last_affected": "2.2.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "615627206357d997d5e6ff9da158997de05235ae"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.2.2",
"v2.2.1",
"v2.2.0",
"v2.1.0",
"v2.0.0",
"v1.2.0",
"v1.1.0",
"v1.0.0",
"v0.13.0",
"v0.12.1",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.9.15",
"v0.9.14",
"v0.9.12",
"v0.9.11",
"v0.9.10",
"v0.9.9",
"v0.9.8",
"v0.9.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1000232.json"
}
}
],
"modified": "2026-10-20T10:46:48.375269623Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2016:2101",
"https://access.redhat.com/errata/RHSA-2017:2912",
"https://access.redhat.com/security/cve/cve-2016-1000232",
"https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/",
"https://www.npmjs.com/advisories/130",
"https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae",
"https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*"
],
"vendor_product": "ibm:api_connect",
"extracted_events": [
{
"range": [
{
"introduced": "5.0.6.0"
},
{
"last_affected": "5.0.6.5"
},
{
"introduced": "5.0.7.0"
},
{
"last_affected": "5.0.7.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:api_connect:5.0.8.0:*:*:*:*:*:*:*"
],
"vendor_product": "ibm:api_connect",
"extracted_events": [
{
"range": [
{
"introduced": "5.0.8.0"
},
{
"last_affected": "5.0.8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:openshift_container_platform:3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openshift_container_platform:3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:openshift_container_platform:3.3:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:openshift_container_platform",
"extracted_events": [
{
"range": [
{
"introduced": "3.1"
},
{
"last_affected": "3.1"
},
{
"introduced": "3.2"
},
{
"last_affected": "3.2"
},
{
"introduced": "3.3"
},
{
"last_affected": "3.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-1000232",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 379335,
"published_at": "2018-09-05T17:29:00.373+00:00"
}