CVE-2023-26136

CVE-2023-26136 is a critical Prototype Pollution vulnerability affecting versions of the 'tough-cookie' package prior to 4.1.3, specifically when using CookieJar with rejectPublicSuffixes=false. This flaw, rated 9.8 CVSS (Critical), allows unauthenticated attackers to achieve high impact on confidentiality, integrity, and availability over the network with low attack complexity. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation. Organizations using affected versions should prioritize patching to mitigate this severe risk.