Security readout for executives and security teams
Plain-English summary
CVE-2022-25858 is a denial-of-service issue in Terser, a JavaScript minifier. A vulnerable regular expression can consume excessive processing time. It does not expose data or allow code execution based on the supplied sources, but it can disrupt build or minification services that process attacker-controlled input.
Executive priority
Treat as a medium-priority dependency fix. Prioritize faster if Terser is used in internet-facing tools, customer build services, or automated pipelines that process untrusted JavaScript.
Technical view
Terser versions before 4.8.1 and versions from 5.0.0 before 5.14.2 are vulnerable to Regular Expression Denial of Service. CVSS 3.1 is 5.3, with network attack vector, low complexity, no privileges, no user interaction, and low availability impact only.
Likely exposure
Exposure is most likely in JavaScript build pipelines, SaaS tools, CI systems, or web services that invoke vulnerable Terser versions on untrusted or user-provided JavaScript. Ordinary applications using Terser only during trusted local builds have lower practical exposure.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. The risk depends on whether an attacker can influence code passed into vulnerable Terser processing. No exploit steps are provided or needed for validation.
Researcher notes
Evidence supports a ReDoS flaw and fixed version ranges, but the bundle does not include CWE mapping, proof of active exploitation, or operational mitigations beyond upgrading and exposure reduction. Keep analysis focused on availability impact.
Mitigation direction
- Upgrade Terser to 4.8.1, 5.14.2, or a later supported version.
- Check package manager lockfiles for direct and transitive Terser dependencies.
- Review WebJars npm packaging if Java applications include Terser through that path.
- Avoid processing untrusted JavaScript with vulnerable Terser versions.
- Follow vendor and ecosystem advisory guidance for dependency replacement.
Validation and detection
- Inventory package-lock, yarn.lock, pnpm-lock, SBOM, and WebJars dependencies for Terser versions.
- Confirm resolved runtime and build-time versions are not in affected ranges.
- Identify services or CI jobs that minify user-controlled JavaScript input.
- Run dependency scanning after upgrades to confirm the advisory is cleared.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-25858 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://snyk.io/vuln/SNYK-JS-TERSER-2806366CVE reference · x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722CVE reference · x_refsource_MISC
- https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135CVE reference · x_refsource_MISC
- https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76bCVE reference · x_refsource_MISC
- https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.