CVE-2022-25758: Regular Expression Denial of Service (ReDoS)
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
Other sources
All versions of the package scss-tokenizer prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
Node.js scss-tokenizer module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) vulnerability in the loadAnnotation() function. A remote attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25758?
CVE-2022-25758 is classified as a Regular Expression Denial of Service (ReDoS) vulnerability.
How do I fix CVE-2022-25758?
To mitigate CVE-2022-25758, update the scss-tokenizer package to version 0.4.3 or later.
Which versions of scss-tokenizer are affected by CVE-2022-25758?
All versions of scss-tokenizer prior to version 0.4.3 are affected by CVE-2022-25758.
Which software applications are vulnerable to CVE-2022-25758?
Software using scss-tokenizer version 0.4.2 and below, as well as IBM Planning Analytics up to version 2.0, are vulnerable to CVE-2022-25758.
What is the nature of the vulnerability in CVE-2022-25758?
CVE-2022-25758 arises from the usage of insecure regular expressions in the loadAnnotation() function.