CVE-2022-25858
1 advisory.
npm/terser CVE-2022-25858: high 7.5, EPSS 3.25%
Terser insecure use of regular expressions leads to ReDoS
Action: Upgrade terser to 4.8.1 or later.
npm i terser@4.8.1npm i terser@5.14.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.8.1 | - |
| 5.0.0 | 5.14.2 | - |
Fixed versions
| 4.8.1 | 5.14.2 |
Sources
- osv: GHSA-4wf5-vphf-c2xc
- https://nvd.nist.gov/vuln/detail/CVE-2022-25858
- https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b
- https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012
- https://github.com/terser/terser
- https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722
- https://snyk.io/vuln/SNYK-JS-TERSER-2806366
CVE-2022-25858 · published · modified · JSON