CVE-2022-37620: High severity Html-minifier Project Html-minifier vulnerability
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.
Other sources
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-37620?
CVE-2022-37620 has been classified as a Regular Expression Denial of Service (ReDoS) vulnerability, which can lead to denial of service conditions.
How do I fix CVE-2022-37620?
To mitigate CVE-2022-37620, upgrade html-minifier to a version higher than 4.0.0.
Which versions of html-minifier are affected by CVE-2022-37620?
CVE-2022-37620 affects the html-minifier version 4.0.0.
Is CVE-2022-37620 present in other packages?
CVE-2022-37620 may also be present in packages that depend on the affected versions of html-minifier, such as html-minifier-terser.
What potential impact does CVE-2022-37620 have on applications?
CVE-2022-37620 can allow attackers to cause denial of service by exploiting inefficient regular expressions.