CVE-2022-37620 kangax html-minifier REDoS vulnerability
Attackers can cause denial of service in applications using html-minifier by exploiting a Regular Expression Denial of Service flaw.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-37620?
CVE-2022-37620 is a high-severity denial of service vulnerability in n/a, published on 31 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.
Weakness: CWE-1333
Which versions are affected by CVE-2022-37620?
2 open source packages ship an affected version, including html-minifier. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
html-minifier npm | All versions to 4.0.0 | None |
html-minifier npm | All versions to 4.0.0 | None |
Products include Kangax Html-Minifier, Terser Html-Minifier-Terser.
How do I fix CVE-2022-37620?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-37620 being exploited?
There is no known exploitation of CVE-2022-37620 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1774657356, CLSA-2026-1792745496, GHSA-pfq8-rq6v-vf5m, MINI-v7v7-j5qf-mwrq, ROOT-APP-NPM-CVE-2022-37620.