PT-2025-10894 · Babel+1 · Babel+2
Mmmsssttt404
·
Published
2025-03-11
·
Updated
2026-06-04
·
CVE-2025-27789
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Babel versions prior to 7.26.10
Babel versions prior to 8.0.0-alpha.17
Description:
The issue arises when using Babel to compile regular expression named capturing groups and the
.replace method on a regular expression that contains named capturing groups, with the code using untrusted strings as the second argument of .replace. This results in generated code with quadratic complexity on some specific replacement pattern strings.Recommendations:
For Babel versions prior to 7.26.10, upgrade
@babel/helpers and @babel/runtime to 7.26.10 and re-compile the code.
For Babel versions prior to 8.0.0-alpha.17, upgrade @babel/helpers and @babel/runtime to 8.0.0-alpha.17 and re-compile the code.
As a temporary workaround, consider avoiding the use of untrusted strings as the second argument of .replace until a patch is applied and the code is re-compiled.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Babel/Helpers
@Babel/Runtime
Babel