TI-2022-08250 Aliases CVE-2022-24373 GHSA-2j79-8pqc-r7x6

Regular expression denial of service (ReDoS) in react-native-reanimated

LOW 36CWE-1333Published 2022-09-30 · Updated 2025-05-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01637 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed react-native-reanimated: 3.0.0-rc.1react-native-reanimated (npm): 2.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	react-native-reanimated	before 3.0.0-rc.1	3.0.0-rc.1	Patch available	CNA
—	react-native-reanimated (npm)	before 2.10.0	2.10.0	Patch available	GHSA-2j79-8pqc-r7x6

react-native-reanimated Vendor— Affected before 3.0.0-rc.1 Fixed in 3.0.0-rc.1 Patch available CNA
react-native-reanimated (npm) Vendor— Affected before 2.10.0 Fixed in 2.10.0 Patch available GHSA-2j79-8pqc-r7x6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:swmansion:react_native_reanimated::::::::	before 2.10.0	Vulnerable	swmansion

cpe:2.3:a:swmansion:react_native_reanimated:*:*:*:*:*:*:*:* Versions before 2.10.0 Vulnerable ·swmansion

Remediation

Fix · CNA react-native-reanimated Fixed in 3.0.0-rc.1
Fix · GHSA-2j79-8pqc-r7x6 react-native-reanimated (npm) Fixed in 2.10.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24373
2026-10-03 Alias added: GHSA-2j79-8pqc-r7x6

References

Exploit 1

https://github.com/software-mansion/react-native-reanimated/pull/3382

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-24373

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences