CVE-2025-27789 – Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

https://notcve.org/view.php?id=CVE-2025-27789

11 Mar 2025 — Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.rep... • https://github.com/babel/babel/pull/17173 • CWE-1333: Inefficient Regular Expression Complexity •