{"id":"CVE-2022-25758","aliases":["CLSA-2026-1776991068","CLSA-2026-1788167387","EUVD-2022-6284","GHSA-7mwh-4pqv-wmr8","UBUNTU-CVE-2022-25758"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02141,"percentile":0.82179,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2022-07-01T20:01:14Z","modified":"2026-10-17T12:56:02Z","fixes":[{"ecosystem":"npm","package":"scss-tokenizer","fixed_in":["0.4.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"scss-tokenizer","fixed_in":["0.2.3-tuxcare.1","0.3.0-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"scss-tokenizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.2"},{"fixed":"0.4.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"scss-tokenizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.3-tuxcare.0"},{"fixed":"0.2.3-tuxcare.1"}]}],"versions":["0.2.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"scss-tokenizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0-tuxcare.0"},{"fixed":"0.3.0-tuxcare.1"}]}],"versions":["0.3.0"]},{"source":"osv","ecosystem":"npm","package":"scss-tokenizer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-node-sass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.0-2","4.13.1-1","4.13.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-node-sass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.14.1+git20200512.e1fc158+dfsg-4","4.14.1+git20200512.e1fc158+dfsg-6","7.0.1+git20211229.3bb51da+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-node-sass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.3+git20221109.ee13eb9+dfsg-2","9.0.0+git20240131.6081731+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-node-sass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.0+git20240131.6081731+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-node-sass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.0+git20240724.107ded9+dfsg-1build1","9.0.0+git20240724.107ded9+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-node-sass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.0+git20240131.6081731+dfsg-3","9.0.0+git20240724.107ded9+dfsg-1build1"]}],"products":[{"vendor":"scss-tokenizer_project","product":"scss-tokenizer"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936782","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/sasstools/scss-tokenizer/issues/45","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25758","tags":["advisory"]},{"url":"https://github.com/sasstools/scss-tokenizer/pull/49","tags":["web"]},{"url":"https://github.com/sasstools/scss-tokenizer/commit/a53b6f233e648cc01acbdd89c58786cf8ba56e35","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7mwh-4pqv-wmr8"},{"url":"https://github.com/sasstools/scss-tokenizer","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-25758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25758","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-25758","title":"Regular Expression Denial of Service (ReDoS)","description":"All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.","status":"published","published":"2022-07-01T20:01:14.328Z","modified":"2024-09-17T01:06:29.282Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-6284","description":"All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.","status":"published","published":"2022-07-01T20:01:14Z","modified":"2024-09-17T01:06:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:52.69419Z"}],"ghsa":[{"id":"GHSA-7mwh-4pqv-wmr8","title":"Regular expression denial of service in scss-tokenizer","description":"All versions of the package `scss-tokenizer` prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `loadAnnotation()` function, due to the usage of insecure regex.","status":"published","published":"2022-07-02T00:00:19Z","modified":"2023-11-29T22:18:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2022-25758","description":"All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.","status":"published","published":"2022-07-01T20:15:07.847Z","modified":"2026-06-17T04:34:13.67Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:22.966735Z"}],"osv":[{"id":"GHSA-7mwh-4pqv-wmr8","title":"Regular expression denial of service in scss-tokenizer","description":"All versions of the package `scss-tokenizer` prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `loadAnnotation()` function, due to the usage of insecure regex.","status":"published","published":"2022-07-02T00:00:19Z","modified":"2023-11-08T04:08:47.839855Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"UBUNTU-CVE-2022-25758","description":"All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.","status":"published","published":"2022-07-01T20:15:00Z","modified":"2026-10-17T12:56:02.358530351Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CLSA-2026-1776991068","title":"TuxCare security update for scss-tokenizer (1 CVE)","description":"TuxCare rebuilt scss-tokenizer to address 1 CVE. Fixed in 0.2.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:47:50.066895822Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1788167387","title":"TuxCare security update for scss-tokenizer (1 CVE)","description":"TuxCare rebuilt scss-tokenizer to address 1 CVE. Fixed in 0.3.0-tuxcare.1.","status":"published","published":"2026-08-31T09:09:47Z","modified":"2026-10-15T09:47:55.348193141Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}