{"id":"CVE-2025-5896","summary":"tarojs taro index.js redos","details":"A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component.","aliases":["GHSA-f5xg-cfpj-2mw6"],"modified":"2026-08-12T04:13:30.006422369Z","published":"2025-06-09T20:31:07.141Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5896.json","cna_assigner":"VulDB","cwe_ids":["CWE-1333","CWE-400"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5896.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5896"},{"type":"ADVISORY","url":"https://vuldb.com/?id.311668"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.585796"},{"type":"REPORT","url":"https://github.com/NervJS/taro/pull/17619"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.311668"},{"type":"FIX","url":"https://github.com/NervJS/taro/commit/c2e321a8b6fc873427c466c69f41ed0b5e8814bf"},{"type":"FIX","url":"https://github.com/NervJS/taro/releases/tag/v4.1.2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nervjs/taro","events":[{"introduced":"0"},{"fixed":"0997d9e2bf9748f931b99e3caaedae06d940c49e"},{"fixed":"c2e321a8b6fc873427c466c69f41ed0b5e8814bf"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:taro:taro:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.1.2"}]}}],"versions":["4.1.0","4.1.1","v4.0.9","v4.1.1","v4.1.0","v4.0.13","v4.0.12","v4.0.10","v4.0.8","v4.0.7","list","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.0-alpha.43","v4.0.0-alpha.42","v4.0.0-alpha.41","v4.0.0-alpha.39","v4.0.0-alpha.38","v4.0.0-alpha.37","v4.0.0-alpha.35","v4.0.0-alpha.34","v4.0.0-alpha.33","v4.0.0-alpha.32","v4.0.0-alpha.31","v4.0.0-alpha.30","v4.0.0-beta.82","v4.0.0-alpha.29","v4.0.0-beta.107","v4.0.0-beta.106","v4.0.0-beta.105","v4.0.0-beta.104","v4.0.0-beta.103","v4.0.0-beta.102","v4.0.0-beta.101","v4.0.0-beta.99","v4.0.0-beta.98","v4.0.0-beta.97","v4.0.0-beta.96","v4.0.0-beta.95","v4.0.0-beta.94","v4.0.0-beta.89","v4.0.0-beta.88","v4.0.0-beta.81","v4.0.0-beta.80","v4.0.0-beta.73","v4.0.0-beta.72","v4.0.0-beta.71","v4.0.0-beta.69","v4.0.0-beta.68","v4.0.0-beta.67","v4.0.0-beta.64","v4.0.0-beta.63","v4.0.0-beta.62","v4.0.0-beta.61","v4.0.0-beta.60","v4.0.0-beta.54","v4.0.0-beta.53","v4.0.0-beta.52","v4.0.0-beta.51","v4.0.0-beta.50","v4.0.0-beta.49","v4.0.0-beta.48","v4.0.0-beta.46","v4.0.0-beta.45","v4.0.0-beta.44","v4.0.0-beta.40","v4.0.0-beta.39","v4.0.0-beta.38","v4.0.0-beta.37","v4.0.0-beta.36","v4.0.0-beta.35","v4.0.0-beta.34","v4.0.0-beta.33","v4.0.0-beta.32","v4.0.0-beta.31","v4.0.0-beta.30","v4.0.0-beta.29","v4.0.0-beta.28","v4.0.0-beta.27","v4.0.0-beta.26","v4.0.0-beta.24","v4.0.0-beta.23","v4.0.0-beta.22","v4.0.0-beta.21","v4.0.0-beta.20","v4.0.0-beta.19","v4.0.0-beta.18","v4.0.0-beta.17","v4.0.0-beta.13","v4.0.0-beta.12","v4.0.0-beta.11","v4.0.0-beta.10","v4.0.0-alpha.3","v4.0.0-alpha.2","v4.0.0-beta.9","v4.0.0-beta.8","v4.0.0-beta.7","v4.0.0-beta.6","v4.0.0-beta.4","v4.0.0-beta.3","v4.0.0-beta.2","v4.0.0-beta.1","v4.0.0-beta.0","v4.0.0-alpha.0","v3.7.0-alpha.8","v3.7.0-alpha.7","v3.7.0-alpha.6","v3.7.0-alpha.5","v3.7.0-alpha.4","v3.7.0-alpha.3","v3.7.0-alpha.2","v3.7.0-alpha.0","v3.5.8","v3.5.11","v3.5.10","v3.5.9","v3.5.7","v3.5.6","v3.5.5","v3.5.4","v3.5.3","v3.5.2","v3.5.1","v3.5.0","v3.4.14","v3.4.13","v3.4.12","v3.4.11","v3.4.10","v3.4.9","v3.4.8","v3.4.7","v3.4.6","v3.4.5","v3.4.4","v3.4.3","v3.4.2","v3.4.1","v3.4.0","v3.3.20","v3.3.19","v3.3.18","v3.3.17","v3.3.16","v3.3.15","v3.3.14","v3.3.13","v3.3.12","v3.3.11","v3.3.10","v3.3.9","v3.3.8","v3.3.7","v3.3.6","v3.3.5","v3.3.4","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.2.16","v3.2.15","v3.2.14","v3.2.13","v3.2.12","v3.2.11","v3.2.10","v3.2.9","v3.2.8","v3.2.7","v3.2.6","v3.2.5","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.5","v3.1.4","v3.1.3","v3.1.2","v3.0.28","v3.1.1","v3.1.0","v3.0.27","v3.0.26","v3.0.25","v3.0.24","v3.0.23","v3.0.22","v3.0.21","v3.0.20","v3.0.19","v3.0.18","v3.0.17","v3.0.16","v3.0.15","v3.0.14","v3.0.13","v3.0.12","v3.0.11","v3.0.9","v3.0.10","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.0","v3.0.0-rc.6","v3.0.0-rc.5","v3.0.0-rc.4","v3.0.0-rc.3","v3.0.0-rc.2","v3.0.0-rc.1","v3.0.0-rc.0","v3.0.0-beta.6","v3.0.0-beta.5","v3.0.0-beta.4","v3.0.0-beta.3","v3.0.0-beta.2","v3.0.0-beta.1","v3.0.0-beta.0","v3.0.0-alpha.9","v3.0.0-alpha.8","v3.0.0-alpha.7","v3.0.0-alpha.6","v3.0.0-alpha.5","v3.0.0-alpha.4","v3.0.0-alpha.3","v3.0.0-alpha.2","v3.0.0-alpha.1","v3.0.0-alpha.0","v3.0.0-experimental.5","v3.0.0-experimental.4","v3.0.0-experimental.3","v3.0.0-experimental.2","v1.3.21","v1.3.20","v1.3.19","v1.3.18","v1.3.16","v1.3.14","v1.3.13","v1.3.12","v1.3.11","v1.3.5","v1.3.9","v1.3.8","v1.3.7","v1.3.6","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.3.0-beta.8","v1.3.0-beta.7","v1.3.0-beta.6","v1.3.0-beta.5","v1.3.0-beta.4","v1.3.0-beta.3","v1.3.0-beta.2","v1.3.0-beta.1","v1.3.0-beta.0","v1.2.26","v1.2.25","v1.2.20","v1.2.19","v1.2.18","v1.2.17","v1.2.16","v1.2.8","v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.2.0-beta.16","v1.2.0-beta.14","v1.2.0-beta.13","v1.2.0-beta.12","v1.2.0-beta.11","v1.2.0-beta.10","v1.2.0-beta.9","v1.2.0-beta.8","v1.2.0-beta.4","v1.2.0-beta.2","v1.2.0-beta.3","v1.1.9","v1.0.0-beta.20","v1.0.0-beta.11","v1.0.0-beta.10","ls","v0.0.50","v0.0.49","v0.0.48","v0.0.47","v0.0.46","v0.0.45","v0.0.34","v0.0.32","v0.0.31","v0.0.30","v0.0.29","v0.0.28","v0.0.27","v0.0.26","v0.0.25","v0.0.24","v0.0.23","v0.0.22","v0.0.21","v0.0.20","v0.0.19","v0.0.18","v0.0.17","v0.0.16","v0.0.15","v0.0.14","v0.0.13","v0.0.12","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5896.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}]}