GHSA-4wf5-vphf-c2xc

Terser insecure use of regular expressions leads to ReDoS

Source: GitHub Advisory Database (reviewed) High CVE-2022-25858

Packages

Ecosystem	Package	Affected	Fixed in
npm	terser	< 4.8.1	4.8.1
npm	terser	>= 5.0.0, < 5.14.2	5.14.2

Details

As written in the advisory (Markdown source, shown as plain text).

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25858 advisory
https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b web
https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012 web
https://github.com/terser/terser package
https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135 web
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722 web
https://snyk.io/vuln/SNYK-JS-TERSER-2806366 web