CVE-2022-25858

Regular Expression Denial of Service (ReDoS)

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Affected

terser

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 SNYK

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

3.25% chance of exploitation in the next 30 days, 88th percentile

Published

2022-07-15

Updated

2024-09-16

Proof-of-concept exploits (2)

• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722
• https://snyk.io/vuln/SNYK-JS-TERSER-2806366

Security advisories

• terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b
• advisories/GHSA-4wf5-vphf-c2xc

References

• CVE Record
• NVD entry