p PatchFirst

CVE-2022-25858

CVE-2022-25858 · Regular Expression Denial of Service (ReDoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

CVSS 5.3 · Medium · EPSS 3.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • terser

    Versions
    • ≥ unspecified, < 4.8.1: Affected (custom)
    • ≥ 5.0.0, < unspecified: Affected (custom)
    • ≥ unspecified, < 5.14.2: Affected (custom)

    Update to 4.8.1; Update to 5.14.2

  • node-terser Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.8.1-1

    Update to 4.8.1-1

  • node-terser Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.8.1-1

    Update to 4.8.1-1

  • node-terser Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.8.1-1

    Update to 4.8.1-1

  • terser npm

    Affected ranges
    • SEMVER: < 4.8.1

    Update to 4.8.1

  • terser npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.14.2

    Update to 5.14.2

  • node-terser Ubuntu:20.04:LTS

    Versions
    • 4.1.2-4ubuntu1
    • 4.1.2-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-terser Ubuntu:22.04:LTS

    Versions
    • 4.1.2-8
    • 4.1.2-9
    • 4.1.2-10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-webengine Ubuntu:22.04:LTS

    Versions
    • 6.2.2+dfsg-6ubuntu2
    • 6.2.4+dfsg-1ubuntu1
    • 6.2.4+dfsg-1ubuntu2
    • 6.2.4+dfsg-6ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-terser Ubuntu:24.04:LTS

    Versions
    • 5.19.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-webengine Ubuntu:24.04:LTS

    Versions
    • 6.4.2-final+dfsg-11
    • 6.4.2-final+dfsg-12
    • 6.4.2-final+dfsg-12build1
    • 6.4.2-final+dfsg-12ubuntu1
    • 6.4.2-final+dfsg-12ubuntu7
    • 6.4.2-final+dfsg-12ubuntu9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-terser Ubuntu:25.10

    Versions
    • 5.38.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-webengine Ubuntu:25.10

    Versions
    • 6.8.3+dfsg-0ubuntu1
    • 6.8.3+dfsg-0ubuntu2
    • 6.9.2+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-terser Ubuntu:26.10

    Versions
    • 5.46.1-4
    • 5.47.1-1
    • 5.49.0-1
    • 5.49.2-1
    • 5.50.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-webengine Ubuntu:26.10

    Versions
    • 6.10.2+dfsg-1
    • 6.10.2+dfsg-4
    • 6.10.2+dfsg-5
    • 6.11.2+dfsg-3ubuntu1
    • 6.11.2+dfsg-3ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-terser Ubuntu:26.04:LTS

    Versions
    • 5.38.0-1
    • 5.46.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • qt6-webengine Ubuntu:26.04:LTS

    Versions
    • 6.9.2+dfsg-2
    • 6.9.2+dfsg-4
    • 6.9.2+dfsg-4build1
    • 6.9.2+dfsg-4build2
    • 6.10.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →