Packages / terser / Security

HighVulnerabilityGHSA-4wf5-vphf-c2xcCVE-2022-25858Published 16 Jul 2022

Terser insecure use of regular expressions leads to ReDoS

Affected releases · terser

  • 5.x5.0.0 – 5.14.1Fixed in 5.14.2
  • 4.x4.0.0 – 4.8.0Fixed in 4.8.1
  • 3.x and older0.0.1 – 3.17.0No fix, no longer updated

On 5.x, the newest line:

npm install terser@5.14.2

  1. Affected

    0.0.1 – 4.8.0

    84 releases

  2. Fixed

    4.8.1

    1 release

  3. Affected

    5.0.0 – 5.14.1

    31 releases

  4. Fixed

    5.14.2 – 5.51.2

    89 releases, latest

205 stable releases of terser, oldest to newest.

What happens

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.