CVE-2022-25858

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
n/a	terser	>= unspecified, < 4.8.1; >= 5.0.0, < unspecified; >= unspecified, < 5.14.2

References

https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135Broken Link
https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76bPatch, Third Party Advisory
https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-TERSER-2806366Exploit, Patch, Third Party Advisory
https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135Broken Link
https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76bPatch, Third Party Advisory
https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-TERSER-2806366Exploit, Patch, Third Party Advisory

Timeline

Published: Jul 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-25867.8It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that CVE-2022-258609.8Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemot CVE-2022-258627.5This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing CVE-2022-258639.8The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing i CVE-2022-258647.8Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escala CVE-2022-258659.8The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch CVE-2022-258669.8The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReada CVE-2022-258677.5The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid paylo CVE-2022-258696.1All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cro CVE-2022-25879.8Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially CVE-2022-258717.5All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be CVE-2022-258725.3All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for a