CVE-2025-27789

What it actually does

Generates a .replace polyfill with quadratic time complexity when processing regular expressions containing named capturing groups and specific untrusted replacement pattern strings.

Why it matters to the business

Applications built with affected Babel versions can experience severe performance degradation or denial of service when processing untrusted input through compiled regex replace operations, potentially disrupting services and increasing compute costs.

How an attack unfolds

An attacker identifies code paths using Babel-compiled regular expressions with named capture groups, supplies a specially crafted replacement string as the second argument to .replace, and triggers repeated execution to exploit the quadratic complexity and exhaust CPU resources.

How to fix it

Upgrade @babel/helpers and @babel/runtime to 7.26.10 (or 8.0.0-alpha.17) or later; upgrading @babel/core to 7.26.10 ensures a compatible helpers version; after the dependency update, fully recompile all affected source code with the patched Babel.

How to confirm the fix worked

Inspect package.json and lockfiles for @babel/helpers/@babel/runtime versions at or above 7.26.10, confirm the generated output no longer contains the vulnerable polyfill, and test regex replace operations with known quadratic-triggering patterns under load.

Typical attack path

1. Locate JavaScript code compiled by vulnerable Babel that uses named capturing groups in regex literals
2. Identify call sites passing untrusted data as the replacement argument to .replace
3. Craft a replacement string that triggers quadratic behavior in the generated polyfill
4. Submit the input repeatedly or at high volume to induce resource exhaustion

How to detect it

Review application and web-server logs for unusually high CPU or long-running requests involving regex replace operations; correlate with source maps or build metadata to identify bundles produced by vulnerable Babel versions; inspect generated JavaScript for the presence of the quadratic polyfill pattern.

What your security team should do

• Immediately update Babel helpers and runtime packages to the fixed releases
• Rebuild and redeploy all transpiled bundles using the updated compiler
• Review application code for regex replace operations on named-capture patterns and add input validation or rate limiting where feasible
• Monitor CPU and request latency metrics for anomalies on services handling user-supplied strings in regex operations