CVE-2025-27789: Babel Compiler DOS Vulnerability

CVE-2025-27789 Overview

CVE-2025-27789 is an algorithmic complexity vulnerability in Babel, a widely-used JavaScript compiler for writing next-generation JavaScript. When using vulnerable versions of Babel to compile regular expression named capturing groups, the compiler generates a polyfill for the .replace method that exhibits quadratic time complexity when processing specific replacement pattern strings. This vulnerability can lead to denial of service conditions when untrusted input is passed to the .replace method.

Critical Impact

Applications compiled with vulnerable Babel versions may experience significant performance degradation or complete denial of service when processing malicious replacement strings through the generated .replace polyfill.

Affected Products

• Babel versions prior to 7.26.10
• Babel versions prior to 8.0.0-alpha.17
• @babel/helpers (all versions before the fix)
• @babel/runtime (all versions before the fix)
• @babel/core (indirect dependency)

Discovery Timeline

• 2025-03-11 - CVE CVE-2025-27789 published to NVD
• 2025-03-11 - Last updated in NVD database

Technical Details for CVE-2025-27789

Vulnerability Analysis

This vulnerability falls under CWE-1333 (Inefficient Regular Expression Complexity), commonly associated with ReDoS (Regular Expression Denial of Service) attacks. The root issue lies in Babel's polyfill generation for the .replace method when dealing with regular expressions that contain named capturing groups.

When Babel compiles code that uses regular expression named capturing groups combined with the .replace method, it generates polyfill code to ensure backward compatibility with older JavaScript environments. However, this generated polyfill implementation has algorithmic complexity issues that result in quadratic O(n²) time complexity when processing certain replacement pattern strings.

For the vulnerability to be exploitable, three conditions must be met: the application must use Babel to compile regular expression named capturing groups, the compiled code must use the .replace method on a regular expression containing named capturing groups, and the second argument to .replace must accept untrusted user input.

Root Cause

The vulnerability stems from inefficient string processing algorithms in the generated polyfill code for the .replace method. When Babel transpiles modern JavaScript code containing named capturing groups in regular expressions, it creates compatibility code that does not handle replacement pattern strings efficiently, leading to quadratic complexity during string replacement operations.

Attack Vector

The attack vector requires local access where an attacker can supply crafted replacement strings to the vulnerable .replace polyfill. An attacker who can control the second argument passed to .replace on a compiled regular expression with named capturing groups can craft malicious input strings that trigger the quadratic complexity behavior.

The exploitation mechanism involves providing specially crafted replacement pattern strings that cause the inefficient algorithm to perform exponentially more operations, resulting in CPU exhaustion and denial of service. The attack is particularly effective when the replacement string contains specific patterns that maximize the algorithmic inefficiency.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-27789

Indicators of Compromise

• Abnormal CPU utilization spikes during string replacement operations in JavaScript applications
• Application hangs or timeouts when processing user-supplied replacement strings
• Memory consumption increases correlated with string replacement operations
• Slow response times in endpoints that process user input through regex replace operations

Detection Strategies

• Audit package.json and package-lock.json files for @babel/helpers, @babel/runtime, or @babel/core versions prior to 7.26.10
• Use software composition analysis (SCA) tools to identify vulnerable Babel dependencies in build pipelines
• Monitor application performance metrics for unusual CPU consumption patterns during string processing
• Review compiled JavaScript output for the presence of vulnerable polyfill code patterns

Monitoring Recommendations

• Implement application performance monitoring (APM) to detect CPU exhaustion events
• Set up alerting for response time anomalies in services that process user-supplied strings
• Monitor build system logs for outdated Babel dependency usage
• Enable resource usage limits and timeouts for string processing operations

How to Mitigate CVE-2025-27789

Immediate Actions Required

• Update @babel/helpers and @babel/runtime to version 7.26.10 or 8.0.0-alpha.17 or later
• Re-compile all JavaScript code after updating Babel dependencies to regenerate polyfills
• Audit applications for user input paths that reach .replace methods on named capturing group regexes
• Consider implementing input validation and length limits on replacement strings

Patch Information

The vulnerability has been fixed in @babel/helpers and @babel/runtime versions 7.26.10 and 8.0.0-alpha.17. While upgrading to @babel/core version 7.26.10 is not strictly required, doing so guarantees the use of a patched @babel/helpers version.

Important: Simply updating Babel dependencies is not sufficient to remediate this vulnerability. After updating the packages, all affected code must be re-compiled to regenerate the polyfill code with the fixed implementation.

For patch details, see the GitHub Pull Request #17173.

Workarounds

• No official workarounds are available according to the vendor advisory
• As a temporary measure, avoid passing untrusted user input as the second argument to .replace on regexes with named capturing groups
• Implement input sanitization and length restrictions on replacement strings before they reach vulnerable code paths
• Consider using alternative string replacement approaches that don't rely on the vulnerable polyfill

# Update Babel dependencies
npm update @babel/helpers @babel/runtime @babel/core

# Verify updated versions
npm list @babel/helpers @babel/runtime @babel/core

# Re-compile all JavaScript code to regenerate polyfills
npm run build