Read the docs
TI-2025-20569 Aliases CVE-2025-27789GHSA-968p-4wvh-cqc8

Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

Priority MEDIUM 61CWE-1333Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-08
Fix Fixed babel (babel): 7.26.10, 8.0.0-alpha.17@babel/helpers (npm): 7.26.10, 8.0.0-alpha.17+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
babelbabelbefore 7.26.10; 8.0.0-alpha.0 to before 8.0.0-alpha.177.26.10, 8.0.0-alpha.17Patch availableCNA
—@babel/helpers (npm)before 7.26.107.26.10Patch availableGHSA-968p-4wvh-cqc8
—@babel/runtime (npm)before 7.26.107.26.10Patch availableGHSA-968p-4wvh-cqc8
—@babel/runtime-corejs2 (npm)before 7.26.107.26.10Patch availableGHSA-968p-4wvh-cqc8
—@babel/runtime-corejs3 (npm)before 7.26.107.26.10Patch availableGHSA-968p-4wvh-cqc8
—@babel/helpers (npm)8.0.0-alpha.0 to before 8.0.0-alpha.178.0.0-alpha.17Patch availableGHSA-968p-4wvh-cqc8
—@babel/runtime (npm)8.0.0-alpha.0 to before 8.0.0-alpha.178.0.0-alpha.17Patch availableGHSA-968p-4wvh-cqc8
—@babel/runtime-corejs2 (npm)8.0.0-alpha.0 to before 8.0.0-alpha.178.0.0-alpha.17Patch availableGHSA-968p-4wvh-cqc8
—@babel/runtime-corejs3 (npm)8.0.0-alpha.0 to before 8.0.0-alpha.178.0.0-alpha.17Patch availableGHSA-968p-4wvh-cqc8
  • babel Vendorbabel Affected before 7.26.10; 8.0.0-alpha.0 to before 8.0.0-alpha.17 Fixed in 7.26.10, 8.0.0-alpha.17 Patch available CNA
  • @babel/helpers (npm) Vendor— Affected before 7.26.10 Fixed in 7.26.10 Patch available GHSA-968p-4wvh-cqc8
  • @babel/runtime (npm) Vendor— Affected before 7.26.10 Fixed in 7.26.10 Patch available GHSA-968p-4wvh-cqc8
  • @babel/runtime-corejs2 (npm) Vendor— Affected before 7.26.10 Fixed in 7.26.10 Patch available GHSA-968p-4wvh-cqc8
  • @babel/runtime-corejs3 (npm) Vendor— Affected before 7.26.10 Fixed in 7.26.10 Patch available GHSA-968p-4wvh-cqc8
  • @babel/helpers (npm) Vendor— Affected 8.0.0-alpha.0 to before 8.0.0-alpha.17 Fixed in 8.0.0-alpha.17 Patch available GHSA-968p-4wvh-cqc8
  • @babel/runtime (npm) Vendor— Affected 8.0.0-alpha.0 to before 8.0.0-alpha.17 Fixed in 8.0.0-alpha.17 Patch available GHSA-968p-4wvh-cqc8
  • @babel/runtime-corejs2 (npm) Vendor— Affected 8.0.0-alpha.0 to before 8.0.0-alpha.17 Fixed in 8.0.0-alpha.17 Patch available GHSA-968p-4wvh-cqc8
  • @babel/runtime-corejs3 (npm) Vendor— Affected 8.0.0-alpha.0 to before 8.0.0-alpha.17 Fixed in 8.0.0-alpha.17 Patch available GHSA-968p-4wvh-cqc8

Remediation

  • Fix · CNA babel (babel) Fixed in 7.26.10, 8.0.0-alpha.17
  • Fix · GHSA-968p-4wvh-cqc8 @babel/helpers (npm) Fixed in 7.26.10 Advisory →
  • Fix · GHSA-968p-4wvh-cqc8 @babel/runtime (npm) Fixed in 7.26.10 Advisory →
  • Fix · GHSA-968p-4wvh-cqc8 @babel/runtime-corejs2 (npm) Fixed in 7.26.10 Advisory →
  • Fix · GHSA-968p-4wvh-cqc8 @babel/runtime-corejs3 (npm) Fixed in 7.26.10 Advisory →
  • Fix · GHSA-968p-4wvh-cqc8 @babel/helpers (npm) Fixed in 8.0.0-alpha.17 Advisory →
  • Fix · GHSA-968p-4wvh-cqc8 @babel/runtime (npm) Fixed in 8.0.0-alpha.17 Advisory →
  • Fix · GHSA-968p-4wvh-cqc8 @babel/runtime-corejs2 (npm) Fixed in 8.0.0-alpha.17 Advisory →
  • Fix · GHSA-968p-4wvh-cqc8 @babel/runtime-corejs3 (npm) Fixed in 8.0.0-alpha.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27789
  2. 2026-10-03 Alias added: GHSA-968p-4wvh-cqc8

References

Advisory 1

Other 4

  • TI-2023-24154 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code CVSS 3.1CRITICAL 9.4
  • TI-2026-32615 Type confusion in babel CVSS 3.1HIGH 8.2
  • TI-2026-36529 Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core CVSS 3.1LOW 3.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences