CVE-2022-25858

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135	Broken Link
https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b	Patch Third Party Advisory
https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012	Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722	Exploit Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JS-TERSER-2806366	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:terser:terser::::::node.js::*
	cpe:2.3:a:terser:terser::::::node.js::*

History

08 Aug 2023, 14:22

Type	Values Removed	Values Added
CWE	~~NVD-CWE-Other~~	CWE-1333

Information

Published : 2022-07-15 20:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-25858

Mitre link : CVE-2022-25858

CVE.ORG link : CVE-2022-25858

JSON object : View

Products Affected

terser

terser

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2022-25858", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2022-07-15T20:15:08.427", "references": [{"url": "https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135", "tags": ["Broken Link"], "source": "report@snyk.io"}, {"url": "https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b", "tags": ["Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012", "tags": ["Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JS-TERSER-2806366", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions."}, {"lang": "es", "value": "El paquete terser versiones anteriores a 4.8.1, a partir de la versi\u00f3n 5.0.0 anteriores a 5.14.2, son vulnerables a una Denegaci\u00f3n de Servicio por Expresi\u00f3n Regular (ReDoS) debido al uso no seguro de expresiones regulares"}], "lastModified": "2023-08-08T14:22:24.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:terser:terser:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "0A470914-3805-4013-9E7D-6AB1241062A9", "versionEndExcluding": "4.8.1"}, {"criteria": "cpe:2.3:a:terser:terser:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "34C8303E-663F-4756-BF89-AA071EFDF7C2", "versionEndExcluding": "5.14.2", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}