# CVE-2022-37259: steal inefficient regular expression complexity in babel

Source: https://junglewise.ai/threats/cve-2022-37259-steal-inefficient-regular-expression-complexity-in-babel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-37259 · Severity: low · CVSS 3.1 · Published 2022-09-21

steal is a JavaScript module loader and builder used in web applications. A regular expression denial of service (ReDoS) vulnerability in the babel.js component can be exploited by providing specially crafted input strings, causing the application to consume excessive CPU and become unresponsive. This could lead to service availability issues in production environments using affected versions.

Technologies: [steal (npm)](https://junglewise.ai/threats/technologies/steal). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-37259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-37259 being exploited in the wild.

**How severe is CVE-2022-37259?** Low severity, with a CVSS score of 3.1, published 21 September 2022.

**Which products and versions are affected?** steal (npm) SEMVER:introduced=0,last_affected=2.3.0.

**Is there a fix for CVE-2022-37259?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-37259 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-37259?** Check whether you run steal (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A ReDoS (Regular Expression Denial of Service) vulnerability exists in the steal module version 2.3.0 and earlier, specifically in the babel.js component's regex pattern used to process string variables. The vulnerability arises from catastrophic backtracking in an inefficiently designed regular expression (CWE-1333) that processes untrusted input strings. An attacker can supply a malicious input string that causes the regex engine to perform exponential backtracking, consuming significant CPU resources and causing the application to hang or become unresponsive. No authentication is required; the attack vector is network-based if the application processes external input. Patches are expected to be available; users should upgrade to a version after 2.3.0.

## Affected products

- stealjs steal 2.3.0 and earlier

## Identifiers

- CVE-2022-37259
- GHSA-rgqx-226f-2xp4

## Timeline

- 2022-09-20: disclosed: NVD publication date
- 2022-09-21: advisory: GitHub Security Advisory published

## References

- [https://github.com/stealjs/steal/issues/1528](https://github.com/stealjs/steal/issues/1528)

## Related threats

- [steal prototype pollution via alias variable](https://junglewise.ai/threats/cve-2022-37265-steal-prototype-pollution-via-alias-variable)
- [steal prototype pollution in npm-convert.js](https://junglewise.ai/threats/cve-2022-37258-steal-prototype-pollution-in-npm-convert-js)
- [StealJS prototype pollution via babel.js](https://junglewise.ai/threats/cve-2022-37266-stealjs-prototype-pollution-via-babel-js)
- [steal prototype pollution via requestedVersion](https://junglewise.ai/threats/cve-2022-37257-steal-prototype-pollution-via-requestedversion)
- [StealJS ReDoS in main.js source variables](https://junglewise.ai/threats/cve-2022-37262-stealjs-redos-in-main-js-source-variables)