Executive brief
Babel, a popular JavaScript transpiler, generates inefficient regular expression code when compiling named capturing groups. If an application uses untrusted user input as the replacement string in a .replace() call on a regex with named groups, an attacker can craft a malicious string that causes the generated code to consume excessive CPU and freeze the application, leading to denial of service.
Technical details
The vulnerability exists in Babel's polyfill for the .replace() method when transpiling regular expression named capturing groups. The generated code has quadratic time complexity when processing certain replacement pattern strings—specifically those containing the substring "
lt;" not followed immediately by ">". An attacker who can control the second argument (replacement string) to .replace() on a regex with named capturing groups can craft input that triggers exponential backtracking in the generated polyfill, causing CPU exhaustion and denial of service. The vulnerability affects Babel when targeting older browsers or JavaScript engines that lack native named capturing group support. Patches are available in @babel/helpers and @babel/runtime versions 7.26.10 and 8.0.0-alpha.17 and later; affected code must be recompiled with the patched version.Affected products
- Babel @babel/helpers <7.26.10, 8.0.0-alpha.0 to 8.0.0-alpha.16
- Babel @babel/runtime <7.26.10, 8.0.0-alpha.0 to 8.0.0-alpha.16
- Babel @babel/runtime-corejs2 <7.26.10, 8.0.0-alpha.0 to 8.0.0-alpha.16
- Babel @babel/runtime-corejs3 <7.26.10, 8.0.0-alpha.0 to 8.0.0-alpha.16
Timeline
- 2025-03-11: disclosed
- 2025-03-11: patched: Patches released in @babel/helpers and @babel/runtime 7.26.10 and 8.0.0-alpha.17