Description
When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to .replace).
Recommendation
Update the @babel/helpers package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0-alpha.0, < 8.0.0-alpha.16 < 7.26.10** Patched version(s): **8.0.0-alpha.17 7.26.10**
References
Could your website be exposed too?
SmartScanner can check your website for Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - @babel/helpers and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - CVE-2025-27789
- Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - @babel/runtime - CVE-2025-27789
- Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity - CVE-2025-58451
- ajv has ReDoS when using `$data` option - CVE-2025-69873
You might also like:
See something that needs correcting? Let us knowUpdated April 16, 2025