Medium severity5.3NVD Advisory· Published Aug 30, 2022· Updated Jun 17, 2026
CVE-2022-25887
CVE-2022-25887
Description
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sanitize-htmlnpm | < 2.7.1 | 2.7.1 |
Affected products
3cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*range: <2.7.1
- (no CPE)range: unspecified
Patches
Vulnerability mechanics
References
6- github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23cnvdPatchThird Party AdvisoryWEB
- github.com/apostrophecms/sanitize-html/pull/557nvdIssue TrackingPatchThird Party AdvisoryWEB
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102nvdPatchThird Party AdvisoryWEB
- security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-cgfm-xwp7-2cvrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-25887ghsaADVISORY
News mentions
0No linked articles in our index yet.