4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5896

CVE-2025-5896: taro-css-to-react-native Regular Expression Denial of Service vulnerability

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5896

CVE-2025-5896:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
taro-css-to-react-native	npm	< 4.1.2	4.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by inefficient regular expressions in the taro-css-to-react-native package. The provided commit c2e321a8b6fc873427c466c69f41ed0b5e8814bf directly addresses these issues by modifying the problematic regular expressions.

In packages/css-to-react-native/src/index.js, the transformDecls function used the regex /(\d+)px/. This regex was found to be inefficient and could lead to ReDoS. The patch replaced it with /(?<!\d)(\d+)px/, which is more efficient and less prone to backtracking issues.
In packages/css-to-react-native/src/transforms/rem.js, the remToPx function used the regex /(\d*\.?\d+)rem/g. This regex was also identified as a source of potential ReDoS. The patch replaced it with /(?<!\d)((?:\d*\.\d+)|\d+)rem/g, which is a more robust and efficient pattern for matching numbers followed by 'rem'.

Both functions process CSS string values, and the vulnerability could be triggered by providing specially crafted CSS input that causes the regular expression engine to enter a state of catastrophic backtracking, leading to high CPU usage and a denial of service. The identified functions are directly involved in parsing and transforming these CSS values using the vulnerable regular expressions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.