{"id":"CVE-2022-25887","published":"2022-08-30T05:00:20Z","modified":"2024-09-17T03:07:00Z","title":"Regular Expression Denial of Service (ReDoS)","vendor":null,"product":null,"tier":"tail","description":{"text":"The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01551,"percentile":0.7507,"provenance":"source"},"cwes":[],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526","tags":["x_refsource_MISC"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102","tags":["x_refsource_MISC"]},{"url":"https://github.com/apostrophecms/sanitize-html/pull/557","tags":["x_refsource_MISC"]},{"url":"https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","tags":["x_refsource_MISC"]}],"priority":{"score":18.7,"factors":[{"name":"EPSS percentile","points":15.01},{"name":"CVSS severity","points":3.71}]},"affectedVersions":[{"vendor":"n/a","product":"sanitize-html","versions":[">= unspecified, < 2.7.1"]}],"affected":[{"ecosystem":"npm","package":"sanitize-html","vulnerableRanges":["<2.7.1"],"patched":["2.7.1"],"from":["GHSA-cgfm-xwp7-2cvr"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6537","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sanitize-html-cve-2016-1000237","parents":[{"from":"CVE-2016-1000237","to":"CVE-2022-25887","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf","https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c"],"basis":"shared function","functions":["sanitizeHtml"]}]},{"from":"CVE-2021-26539","to":"CVE-2022-25887","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da","https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c"],"basis":"shared function","functions":["sanitizeHtml"]}]}],"children":[{"from":"CVE-2022-25887","to":"CVE-2024-21501","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sanitize-html","fromFixed":"2.7.1","toFixed":"2.12.1","daysApart":543},{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4"],"basis":"shared function","functions":["sanitizeHtml"]}]}],"packageHistory":[{"cve":"CVE-2019-25225","published":"2025-09-08","fixed":"2.0.0-beta","kev":false},{"cve":"CVE-2021-26539","published":"2021-02-08","fixed":"2.3.1","kev":false},{"cve":"CVE-2021-26540","published":"2021-02-08","fixed":"2.3.2","kev":false,"link":{"from":"CVE-2021-26540","to":"CVE-2022-25887","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:sanitize-html","fromFixed":"2.3.2","toFixed":"2.7.1","daysApart":568}]}},{"cve":"CVE-2022-25887","published":"2022-08-30","fixed":"2.7.1","kev":false},{"cve":"CVE-2024-21501","published":"2024-02-24","fixed":"2.12.1","kev":false},{"cve":"CVE-2026-40186","published":"2026-04-15","fixed":"2.17.3","kev":false},{"cve":"CVE-2026-44990","published":"2026-06-12","fixed":"2.17.4","kev":false}],"package":"npm:sanitize-html"}}