CVE-2022-25858: Terser Regular Expression Denial of Service (ReDoS)
Summary
CVE-2022-25858: Terser insecure use of regular expressions leads to ReDoS. Affects terser across 2 version ranges.
< 4.8.1
>= 5.0.0, < 5.14.2
Fixed in 4.8.1 or 5.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- node-terser · Debian:11
The same CVE-2022-25858 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Terser is an npm package used for JavaScript minification and compression. It is commonly employed in build processes to reduce the size of JavaScript files, improving website performance. However, versions prior to 4.8.1 and between 5.0.0 to 5.14.2 are susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability. This vulnerability arises from the insecure usage of regular expressions within the package.
Vulnerability Detail
The Terser package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks due to insecure handling of regular expressions. An attacker can exploit this vulnerability by providing specially crafted input that triggers excessive backtracking in the regular expression engine. This can lead to a denial of service condition, causing the application to become unresponsive or crash. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 5.51.2 as of 22 Oct 2026
npm install terser@5.51.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.8.14.8.1npm install terser@4.8.1 -
>= 5.0.0, < 5.14.25.14.2npm install terser@5.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can consider implementing input validation and limiting the complexity of the input processed by Terser. By validating and sanitizing user input, the likelihood of triggering the vulnerable regular expressions can be reduced. However, this workaround may not provide complete protection and should be seen as a temporary measure until the package is updated to a fixed version.
Conclusion
The Terser package is vulnerable to a Regular Expression Denial of Service (ReDoS) issue. To mitigate this vulnerability, it is crucial to update the package to version 4.8.1 or above (for versions prior to 5.0.0) or version 5.14.2 or later (for versions between 5.0.0 and 5.14.2). Implementing input validation and limiting input complexity can serve as temporary workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for terser →
FAQ
Terser is an npm package used for JavaScript minification and compression. It helps reduce the size of JavaScript files, improving website performance.
Regular Expression Denial of Service (ReDoS) is a type of vulnerability where a maliciously crafted input can cause a regular expression to take an excessive amount of time to process, leading to a denial of service condition.
The vulnerability in Terser can be exploited by an attacker to cause a denial of service condition. This can result in the application becoming unresponsive or crashing, impacting the availability of the service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
You can find more information about this vulnerability, including the CVE identifier, on the Vulert platform at Vulert Scanner.
