GitHub Advisoryadvisory · npm

GHSA-f5xg-cfpj-2mw6 taro-css-to-react-native Regular Expression Denial of Service vulnerability

MEDIUM Published 2025-06-09 Modified 2025-06-09 Official page ↗
Aliases
CVE-2025-5896
Ecosystem
npm
Packages
taro-css-to-react-native
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333, CWE-400
Reviewed
2025-06-09

Affected packages

• npm taro-css-to-react-native: < 4.1.2 → fixed in 4.1.2

Description

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component.

Related

Alias · CVE (1)

  • CVE-2025-5896 A vulnerability was found in tarojs taro up to 4.1.1. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References