What’s Vulnerable › Vulnerabilities

CVE-2022-25858: Regular Expression Denial of Service (ReDoS)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-15 · updated 2026-06-17
• Weakness: CWE-1333

Description

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Affected products

• terser: before 4.8.1; from 5.0.0 before 5.14.2 — fixed in 4.8.1, 5.14.2
• Npm Terser: before 4.8.1; from 5.0.0 before 5.14.2 — fixed in 4.8.1, 5.14.2

How to fix

Upgrade to a fixed version: terser 4.8.1, 5.14.2; Npm Terser 4.8.1, 5.14.2. Check the vendor advisory for mitigations.

References

• https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135
• https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b
• https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722
• https://snyk.io/vuln/SNYK-JS-TERSER-2806366
• https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135
• https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b
• https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722
• https://snyk.io/vuln/SNYK-JS-TERSER-2806366

Get alerted when CVE-2022-25858 or the next vulnerability affects your stack