CVE-2022-24373

Regular Expression Denial of Service (ReDoS)

The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.

Affected

react-native-reanimated

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 SNYK

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

1.64% chance of exploitation in the next 30 days, 76th percentile

Published

2022-09-30

Updated

2025-05-20

Proof-of-concept exploits (2)

• software-mansion/react-native-reanimated/pull/338211024★ · 2026-10-16
• https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507

Security advisories

• advisories/GHSA-2j79-8pqc-r7x6

References

• CVE Record
• NVD entry