# Tough-cookie vulnerability (transitive dependency)

**URL:** <https://community.developer.atlassian.com/t/tough-cookie-vulnerability-transitive-dependency/91196>\
**Category:** Confluence Cloud\
**Tags:** vulnerability, security\
**Created:** [April 16, 2025, 7:48am UTC](https://community.developer.atlassian.com/t/tough-cookie-vulnerability-transitive-dependency/91196 "2025-04-16T07:48:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bartlomiej1](https://avatars.discourse-cdn.com/v4/letter/b/48db29/32.png) [@Bartlomiej1](https://community.developer.atlassian.com/u/Bartlomiej1)\
**Post date:** [April 16, 2025, 7:48am UTC](https://community.developer.atlassian.com/t/tough-cookie-vulnerability-transitive-dependency/91196/1 "2025-04-16T07:48:02Z")

</div>

Hello,

We are the vendor of two marketplace apps for Confluence Cloud based on the atlassian-connect-express library (latest 11.5.3 version). Our vulnerabilities scanners reported a security risk rated as high in the outdated version of tough-cookie v2.5.0 library, which is used in the atlassian-connect-express (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes).

My question is if it is planned to fix that (updating that package for example) and when we can expect a new atlassian-connect-express version providing no high security risks.

Thank you in advance for your quick response!

Best regards,  
Bartłomiej