GitHub Advisoryadvisory · npm

GHSA-4wf5-vphf-c2xc Terser insecure use of regular expressions leads to ReDoS

HIGH Published 2022-07-16 Modified 2023-03-13 Official page ↗
Aliases
CVE-2022-25858
Ecosystem
npm
Packages
terser
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2022-07-20

Affected packages

• npm terser: < 4.8.1 → fixed in 4.8.1 • npm terser: >= 5.0.0, < 5.14.2 → fixed in 5.14.2

Description

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Related

Alias · CVE (1)

  • CVE-2022-25858 The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References