CVE-2022-24373: react-native-reanimated vulnerable to ReDoS
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.21578%
CWE
Published
10/1/2022
Updated
8/17/2023
KEV Status
No
Technology
JavaScript
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| react-native-reanimated | npm | < 2.10.0 | 2.10.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems directly from the regex pattern defined in the NUMBER constant within Colors.ts, as shown in the commit diff. This regex was used for validating numeric components in color values (like RGB/A, HSL/A). The original pattern contained ambiguous quantifiers (\d* and .?) that permitted multiple evaluation paths, enabling ReDoS attacks when matching attacker-controlled strings. The patched commit specifically addresses this by restructuring the regex to eliminate ambiguous paths while maintaining functionality.