CVE-2022-25887: Vulnerability in sanitize-html Package
Summary
CVE-2022-25887: Sanitize-html Vulnerable To REDoS Attacks. Affects sanitize-html versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Also tracked for
- node-sanitize-html · Debian:12
The same CVE-2022-25887 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sanitize-html package is an npm package used for sanitizing HTML input to prevent cross-site scripting (XSS) attacks. It provides a set of functions to remove potentially malicious HTML tags and attributes from user-generated content. However, versions before 2.7.1 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability arises from insecure global regular expression replacement logic used for HTML comment removal.
Vulnerability Detail
The vulnerability in sanitize-html allows an attacker to perform a ReDoS attack by providing specially crafted input. When the package attempts to remove HTML comments, the insecure regular expression replacement logic can be exploited to cause excessive backtracking. This can lead to a denial of service (DoS) condition, where the application becomes unresponsive or crashes. The impact of this vulnerability is high, as it can be exploited remotely without authentication, and it does not require user interaction.
How To Fix
Latest published version: 2.18.1 as of 23 Oct 2026
npm install sanitize-html@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1
This is the first release that contains the fix.
npm install sanitize-html@2.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the sanitize-html package to mitigate the risk.
Conclusion
The sanitize-html package before version 2.7.1 is vulnerable to a ReDoS attack due to insecure global regular expression replacement logic. To mitigate this vulnerability, it is crucial to upgrade to version 2.7.1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sanitize-html →
FAQ
sanitize-html is an npm package used for sanitizing HTML input to prevent cross-site scripting (XSS) attacks. It provides functions to remove potentially malicious HTML tags and attributes from user-generated content.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that exploits inefficient regular expressions. By providing specially crafted input, an attacker can cause the regular expression matching algorithm to enter into an exponential time complexity, leading to excessive backtracking and a significant impact on system performance.
If your application uses an outdated version of the sanitize-html package (before 2.7.1), it is vulnerable to a ReDoS attack. An attacker can exploit this vulnerability to cause a denial of service condition, potentially rendering your application unresponsive or crashing it.
No, authentication is not required to exploit this vulnerability. An attacker can remotely exploit this vulnerability without any authentication.
No, user interaction is not required to exploit this vulnerability. An attacker can exploit this vulnerability without any user interaction.
References
Related vulnerabilities
Recent vulnerabilities recorded for sanitize-html.
