CVE-2026-22809: Amauri Tarteaucitronjs

Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days.

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

Affected products

• Amauri Tarteaucitronjs: before 1.29.0 (fixed in 1.29.0)

Published 2026-01-13. Last modified 2026-06-17.