CVE-2025-2792
@mozilla/readability Denial of Service through Regex
Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.
Additional Details are available at Bugzilla
Credit: DayShift
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-3p6v-hrg8-8qj7
@mozilla/readability Denial of Service through Regex
Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.
Additional Details are available at Bugzilla
Credit: DayShift
- Record
GHSA-3p6v-hrg8-8qj7- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVGHSA-3p6v-hrg8-8qj7
@mozilla/readability Denial of Service through Regex
Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.
Additional Details are available at Bugzilla
Credit: DayShift
- Record
GHSA-3p6v-hrg8-8qj7- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@mozilla/readabilitynpm |
before 0.6.0 | 0.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-2792 is a low vulnerability (CVSS 2.9) in @mozilla/readability, published March 26, 2025. No source lists public exploit code. Fixed in @mozilla/readability 0.6.0.