tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

Affected: npm: tarteaucitronjs

## Summary

A potential Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the `issuu_id` parameter.

## Details

The issue was caused by the use of insufficiently constrained regular expressions applied to attacker-controlled input:

if (issuu_id.match(/\d+\/\d+/)) { issuu_embed = '#' + issuu_id; } else if (issuu_id.match(/d=(.*)&u=(.*)/)) { issuu_embed = '?' + issuu_id; }

These expressions are not anchored and rely on greedy patterns (`.*`). When evaluated against specially crafted input, they may cause excessive backtracking, leading to high CPU consumption and potential denial of service.

## Impact

An attacker able to control the `issuu_id` parameter could exploit this vulnerability to degrade performance or cause temporary service unavailability through CPU exhaustion.

No confidentiality or integrity impact was identified.

## Fix https://github.com/AmauriC/tarteaucitron.js/commit/f0bbdac2fdf3cd24a325fc0928c0d34abf1b7b52

The logic was simplified and hardened by removing ambiguous regular expressions and enforcing strict input validation:

if (issuu_id.match(/^\d+\/\d+$/)) { issuu_embed = '#' + issuu_id; } else { issuu_embed = '?' + issuu_id; }

This change eliminates the risk of catastrophic backtracking and prevents ReDoS conditions.

Additionally, code related to the legacy "Alexa Rank" service was removed. This service, historically provided by…