{"action":"Upgrade tarteaucitronjs to 1.29.0 or later.","affected":[{"fixed":"1.29.0","introduced":"0"}],"component":"tarteaucitronjs","cve_ids":["CVE-2026-22809"],"ecosystem":"npm","epss":0.00128,"exploited":false,"fixed_versions":["1.29.0"],"ghsa_id":"GHSA-q5f6-qxm2-mcqm","id":"tcs_01M5KG58N5DCH9S5WZ4EP1YJJK","modified_at":"2026-02-03T02:59:54.570606Z","published_at":"2026-01-13T20:35:28Z","references":["https://osv.dev/vulnerability/GHSA-q5f6-qxm2-mcqm","https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q5f6-qxm2-mcqm","https://nvd.nist.gov/vuln/detail/CVE-2026-22809","https://github.com/AmauriC/tarteaucitron.js/commit/f0bbdac2fdf3cd24a325fc0928c0d34abf1b7b52","https://github.com/AmauriC/tarteaucitron.js"],"severity":{"label":"medium","score":4.4},"sources":[{"source":"osv","source_id":"GHSA-q5f6-qxm2-mcqm","url":"https://osv.dev/vulnerability/GHSA-q5f6-qxm2-mcqm"}],"summary":"tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability"}