Only used in one line, and module is 8 years old with no fix available for high severity issue:
tough-cookie <=2.3.2
Severity: high
Regular Expression Denial of Service in tough-cookie - https://github.com/advisories/GHSA-g7q5-pjjr-gqvp
ReDoS via long string of semicolons in tough-cookie - https://github.com/advisories/GHSA-qhv9-728r-6jqg
No fix available
node_modules/request-cookies/node_modules/tough-cookie
request-cookies *
Depends on vulnerable versions of tough-cookie
node_modules/request-cookies