Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2022-25858

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

VectorNETWORK

PublishedJul 15, 2022, 20:15

Published Byreport@snyk.io

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

terser(npm)04.8.1N/A

terser(npm)5.0.05.14.2N/A

References

https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135
https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b
https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722
https://snyk.io/vuln/SNYK-JS-TERSER-2806366

Weakness Type

CWE-1333

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK