Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

The core impact of CVE-2025-27789 lies in the potential for denial-of-service (DoS) through performance degradation. When Babel compiles code utilizing regular expression named capturing groups and encounters specific replacement patterns, it generates a polyfill for the .replace method that exhibits quadratic time complexity. This means the execution time of the replacement operation grows proportionally to the square of the input size. An attacker could craft malicious input strings designed to trigger this quadratic behavior, effectively overwhelming the application's resources and rendering it unresponsive. The blast radius is broad, impacting any application relying on Babel to compile code with named capturing groups and vulnerable versions. While not directly exploitable for data theft, the performance impact can disrupt service and potentially lead to cascading failures.

Applications built with Babel and utilizing regular expression named capturing groups are at risk. This includes web applications, Node.js servers, and any other JavaScript projects that rely on Babel for transpilation. Projects using older versions of Babel or those with complex regular expression patterns are particularly vulnerable.

• nodejs: Monitor CPU usage during regular expression operations using tools like top or htop. Look for unexpected spikes correlated with specific input patterns.

top -n 1 | grep babel

• nodejs: Inspect Babel configuration files for the use of named capturing groups. Review codebases for instances of .replace calls with complex regular expressions. • generic web: Monitor application logs for errors or warnings related to performance issues or excessive CPU usage during regular expression processing.

1. 2025-03-11Disclosure

   disclosure

1. 已保留2025-03-06
2. 发布日期2025-03-11
3. 修改日期2026-02-04
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2025-27789 is to upgrade the @babel/helpers package to version 7.26.10 or later. This version includes a fix that addresses the quadratic complexity issue. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider temporarily limiting the use of regular expression named capturing groups in critical code paths. While not a complete solution, this can reduce the likelihood of triggering the vulnerability. There are no specific WAF or proxy rules that can directly address this vulnerability, as it resides within the compiled code. Detection can be challenging, but monitoring application performance for unexpected spikes in CPU usage during regular expression operations might indicate exploitation.