GHSA-968p-4wvh-cqc8 CVE-2025-27789
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
- Severity
- 6.2 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.56%
- Chance of exploitation in the next 30 days. Higher than 46.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
- Available
- 4 packages have a fixed version
Description
Impact
When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to .replace).
Your generated code is vulnerable if all the following conditions are true:
- You use Babel to compile regular expression named capturing groups
- You use the
.replacemethod on a regular expression that contains named capturing groups - Your code uses untrusted strings as the second argument of
.replace
If you are using @babel/preset-env with the targets option, the transform that injects the vulnerable code is automatically enabled if:
- you use duplicated named capturing groups, and target any browser older than Chrome/Edge 126, Opera 112, Firefox 129, Safari 17.4, or Node.js 23
- you use any named capturing groups, and target any browser older than Chrome 64, Opera 71, Edge 79, Firefox 78, Safari 11.1, or Node.js 10
You can verify what transforms @babel/preset-env is using by enabling the debug option.
Patches
This problem has been fixed in @babel/helpers and @babel/runtime 7.26.10 and 8.0.0-alpha.17, please upgrade. It's likely that you do not directly depend on @babel/helpers, and instead you depend on @babel/core (which itself depends on @babel/helpers). Upgrading to @babel/core 7.26.10 is not required, but it guarantees that you are on a new enough @babel/helpers version.
Please note that just updating your Babel dependencies is not enough: you will also need to re-compile your code.
Workarounds
If you are passing user-provided strings as the second argument of .replace on regular expressions that contain named capturing groups, validate the input and make sure it does not contain the substring $< if it's then not followed by > (possibly with other characters in between).
References
This vulnerability was reported and fixed in https://github.com/babel/babel/pull/17173.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @babel/helpers | < 7.26.10 |
7.26.10 |
| @babel/helpers | >= 8.0.0-alpha.0, < 8.0.0-alpha.17 |
8.0.0-alpha.17 |
| @babel/runtime | < 7.26.10 |
7.26.10 |
| @babel/runtime | >= 8.0.0-alpha.0, < 8.0.0-alpha.17 |
8.0.0-alpha.17 |
| @babel/runtime-corejs2 | < 7.26.10 |
7.26.10 |
| @babel/runtime-corejs2 | >= 8.0.0-alpha.0, < 8.0.0-alpha.17 |
8.0.0-alpha.17 |
| @babel/runtime-corejs3 | < 7.26.10 |
7.26.10 |
| @babel/runtime-corejs3 | >= 8.0.0-alpha.0, < 8.0.0-alpha.17 |
8.0.0-alpha.17 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
@babel/helpers npm → 7.26.10
- npm
npm install @babel/helpers@7.26.10- yarn
yarn add @babel/helpers@7.26.10- pnpm
pnpm add @babel/helpers@7.26.10
@babel/runtime npm → 7.26.10
- npm
npm install @babel/runtime@7.26.10- yarn
yarn add @babel/runtime@7.26.10- pnpm
pnpm add @babel/runtime@7.26.10
@babel/runtime-corejs2 npm → 7.26.10
- npm
npm install @babel/runtime-corejs2@7.26.10- yarn
yarn add @babel/runtime-corejs2@7.26.10- pnpm
pnpm add @babel/runtime-corejs2@7.26.10
@babel/runtime-corejs3 npm → 7.26.10
- npm
npm install @babel/runtime-corejs3@7.26.10- yarn
yarn add @babel/runtime-corejs3@7.26.10- pnpm
pnpm add @babel/runtime-corejs3@7.26.10
Severity breakdown
CVSS 3.1 6.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7wch-p9px-956x Forge: Regular expression denial of service in PEM decoding (pem.decode) | High | Same weakness, CWE-1333 |
| GHSA-xcq7-p3pf-p88h OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api | Medium | Same weakness, CWE-1333 |
| GHSA-xgh8-jp6q-p5x8 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes | High | Same weakness, CWE-1333 |
| GHSA-rxp7-6hxx-x8q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process | Medium | Same weakness, CWE-1333 |
| GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | High | Same weakness, CWE-1333 |
| GHSA-4ffr-jq9g-5ffx Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service | High | Same weakness, CWE-1333 |
| GHSA-m64x-33q8-m5h7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines | High | Same weakness, CWE-1333 |
| GHSA-2g7p-5934-q4w7 Payload: ReDoS in Multipart Content-Type Validation | High | Same weakness, CWE-1333 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor