Fix CVE–2022–25858

[debricked]

CVE–2022–25858

Vulnerability details

Description

NVD

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

GitHub

Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

CVSS details - 7.5

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity	None
Availability	High

References

    Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS · CVE-2022-25858 · GitHub Advisory Database · GitHub
    NVD - CVE-2022-25858
    THIRD PARTY
    backport fix to potential regexp DDOS · terser/terser@d8cc569 · GitHub
    fix potential regexp DDOS · terser/terser@a4da734 · GitHub
    terser/evaluate.js at master · terser/terser · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE