Regular Expression Vulnerability in Babel Compiler Affecting JavaScript Applications

CVE-2025-27789

What is CVE-2025-27789?

A vulnerability has been identified in the Babel Compiler that affects the handling of regular expression named capturing groups. In specific versions of Babel prior to 7.26.10 and 8.0.0-alpha.17, when compiled regular expressions utilize the .replace method with named capturing groups, the compiler generates polyfills that can exhibit quadratic complexity with certain replacement patterns. This poses a risk when untrusted strings are used as arguments, allowing for potential code execution vulnerabilities. It is essential for users to upgrade to updated versions of @babel/helpers and @babel/runtime to mitigate this issue. Users must also re-compile their code after updating to ensure the security of their applications.

References