tarteaucitron.js 1.37.0 was released on October 15, 2026. It includes two security fixes and an update to the cookie list associated with the OpenAI service.
The changes are documented in the official GitHub release.
Fixing attribute validation in getElemAttr
The first fix concerns the internal getElemAttr function, which retrieves HTML attribute values.
An issue was identified in the URL validation mechanism: under certain circumstances, the check could target a different attribute from the one that needed validation.
The fix ensures that the protection applies to the expected attribute.
This correction was contributed by @AploSec and is documented in commit 068653b.
URL validation is important when a library processes HTML attributes originating from configuration or page content.
Fixing a potential ReDoS in cookie.purge
The second fix concerns tarteaucitron.cookie.purge, a function involved in removing cookies.
A potential ReDoS issue, short for Regular Expression Denial of Service, was identified.
This type of issue occurs when a regular expression may require excessive processing time for certain inputs. Depending on the circumstances, it can cause significant JavaScript slowdowns.
The fix aims to reduce this risk in the cookie removal function.
It was also contributed by @AploSec and is available in commit 60faaba.
The release does not provide a detailed exploitation scenario or severity assessment. It would therefore be inappropriate to assume that active exploitation has been observed.
OpenAI cookie list update
Version 1.37.0 also updates the list of cookies associated with the OpenAI service introduced in the previous release.
This change adjusts the service declaration to reflect the cookies identified in its integration.
Third-party cookie lists may change over time. Maintaining them is part of keeping service integrations aligned with provider behavior.
This update does not mean that every OpenAI product uses the same cookies or has identical consent requirements. The assessment still depends on the integration actually used by the website.
Why updating matters
Both security fixes concern the internal behavior of tarteaucitron.js and are relevant independently of whether the OpenAI service is used.
I therefore recommend updating open source installations to a version containing these corrections.
Version 1.37.0 is available on GitHub.
After updating, the usual checks remain useful: banner display, consent panel opening, service acceptance and refusal, and cookie removal when consent is withdrawn.
Thanks for the security reports
Thanks to @AploSec for both reports and their associated fixes.
Security contributions are particularly important for a library used across many websites. They help identify issues that may be difficult to detect during routine development.
Addressing these reports is part of the ongoing maintenance of tarteaucitron.js, alongside functional fixes, accessibility improvements and third-party service updates.
