Junglewise Threat Intelligence

CVE-2022-25858: Terser regular expression denial of service

CVE-2022-25858 · Severity: low · CVSS 3.1 · Published 2022-07-16

Executive brief

Terser is a widely-used JavaScript minification and compression tool. The tool contains insecure regular expressions that can be exploited to cause a denial-of-service condition, where processing of specially-crafted JavaScript code causes the tool to consume excessive CPU and become unresponsive. An attacker could exploit this by providing malicious code to be minified, causing service disruption for any system using Terser as part of its build pipeline.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) attack, classified as CWE-1333, arising from insecure use of regular expressions in Terser's expression evaluation component (lib/compress/evaluate.js). The root cause is catastrophic backtracking in a vulnerable regex pattern similar to /A(B|C+)+D/, where the nested quantifiers cause exponential time complexity when matching fails. An attacker can trigger this by providing JavaScript code containing specially-crafted string patterns to the Terser minification tool with the unsafe=true compression option enabled. The attack requires no authentication or user interaction beyond submitting code for minification; processing a 30-character malicious string causes the regex engine to consume several seconds of CPU. Patches are available in versions 4.8.1 (for the 4.x branch) and 5.14.2 (for the 5.x branch).

Affected products

  • Terser Terser <4.8.1, >=5.0.0 and <5.14.2

Timeline

  • 2022-05-02: disclosed
  • 2022-07-15: advisory: NVD published
  • 2022-07-16: advisory: GHSA published
  • 2022-07-20: patched: Patches available in 4.8.1 and 5.14.2

References