GitHub Advisoryadvisory · npm

GHSA-79vf-hf9f-j9q8 @vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability

MEDIUM Published 2025-06-09 Modified 2025-06-09 Official page ↗
Aliases
CVE-2025-5897
Ecosystem
npm
Packages
@vue/cli-plugin-pwa
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333, CWE-400
Reviewed
2025-06-09

Affected packages

• npm @vue/cli-plugin-pwa: <= 5.0.8 (no fix yet)

Description

A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.

Related

Alias · CVE (1)

  • CVE-2025-5897 A vulnerability was found in vuejs vue-cli up to 5.0.8. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References