{"id":"CVE-2022-37620","aliases":["CLSA-2026-1774657356","CLSA-2026-1792745496","CLSA-2026-1793867521","EUVD-2022-7144","GHSA-pfq8-rq6v-vf5m","ROOT-APP-NPM-CVE-2022-37620"],"status":"published","title":"kangax html-minifier REDoS vulnerability","description":"A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01351,"percentile":0.71693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2022-10-31T00:00:00Z","modified":"2026-11-05T13:15:15Z","fixes":[{"ecosystem":"TuxCare:npm","package":"html-minifier","fixed_in":["3.5.21-tuxcare.1","4.0.0-tuxcare.1","3.5.21-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/html-minifier","fixed_in":["3.5.21-root.io.1","3.5.21-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"html-minifier","fixed_in":["3.5.21-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"html-minifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"html-minifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.21-tuxcare.0"},{"fixed":"3.5.21-tuxcare.1"}]}],"versions":["3.5.21"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"html-minifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-tuxcare.0"},{"fixed":"4.0.0-tuxcare.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"html-minifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.21-tuxcare.0"},{"fixed":"3.5.21-tuxcare.3"}]}],"versions":["3.5.21","3.5.21-tuxcare.1","3.5.21-tuxcare.2"]},{"source":"osv","ecosystem":"npm","package":"html-minifier","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/html-minifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-root.io.1"},{"fixed":"3.5.21-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"html-minifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-aikido.2"}]}]}],"products":[{"vendor":"kangax","product":"html-minifier"},{"vendor":"terser","product":"html-minifier-terser"}],"references":[{"url":"https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L1338","tags":["x_transferred","Product","web"]},{"url":"https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L294","tags":["x_transferred","Product","web"]},{"url":"https://github.com/kangax/html-minifier/issues/1135","tags":["x_transferred","Issue Tracking","Mitigation","Third Party Advisory","report","web"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-HTMLMINIFIER-3091181","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37620","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pfq8-rq6v-vf5m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37620.json","tags":["advisory"]},{"url":"https://github.com/kangax/html-minifier","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-37620","description":"A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.","status":"published","published":"2022-10-31T00:00:00Z","modified":"2025-06-01T13:26:16.095Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-7144","description":"A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.","status":"published","published":"2022-10-31T00:00:00Z","modified":"2025-06-01T13:26:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:33.750801Z"}],"ghsa":[{"id":"GHSA-pfq8-rq6v-vf5m","title":"kangax html-minifier REDoS vulnerability","description":"A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.","status":"published","published":"2022-10-31T19:00:36Z","modified":"2025-06-11T17:34:38Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2022-37620","description":"A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.","status":"published","published":"2022-10-31T12:15:10.137Z","modified":"2026-06-17T04:55:09.607Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"CVE-2022-37620","description":"A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.","status":"published","published":"2022-10-31T00:00:00Z","modified":"2026-10-28T02:30:22.223638251Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-pfq8-rq6v-vf5m","title":"kangax html-minifier REDoS vulnerability","description":"A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.","status":"published","published":"2022-10-31T19:00:36Z","modified":"2026-09-10T03:49:46.643513657Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"CLSA-2026-1774657356","title":"TuxCare security update for html-minifier (1 CVE)","description":"TuxCare rebuilt html-minifier to address 1 CVE. Fixed in 3.5.21-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.171094181Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1792745496","title":"TuxCare security update for html-minifier (1 CVE)","description":"TuxCare rebuilt html-minifier to address 1 CVE. Fixed in 4.0.0-tuxcare.1.","status":"published","published":"2026-10-23T08:51:36Z","modified":"2026-10-23T13:45:05.01664673Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793867521","title":"TuxCare security update for html-minifier (1 CVE)","description":"TuxCare rebuilt html-minifier to address 1 CVE. Fixed in 3.5.21-tuxcare.3.","status":"published","published":"2026-11-05T09:32:01Z","modified":"2026-11-05T13:15:15.095819314Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"ROOT-APP-NPM-CVE-2022-37620","title":"CVE-2022-37620 in @rootio/html-minifier - Patched by Root","description":"Root has patched CVE-2022-37620 in the @rootio/html-minifier package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:49:28Z","modified":"2026-06-05T01:30:39.148606205Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}