CVE-2025-5897: @vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability

The vulnerability lies in the HtmlPwaPlugin.js file, specifically within the HtmlPwaPlugin class. The apply method of this class registers a callback function that is executed during the webpack compilation process. This callback uses String.prototype.replace with a regular expression to modify the HTML content. The original regular expression /<link rel=\"icon\"[^>]+>/ was susceptible to ReDoS attacks. An attacker could provide a malicious HTML string that causes the regex engine to enter a state of catastrophic backtracking, leading to excessive CPU consumption and a denial of service. The patch d7eb1fdfff4f71f9d7ef7a20a88f42ca582ebfca mitigates this by changing the regex to /<link rel=\"icon\"(?!<link rel=\"icon\")[^>]+>/, which prevents the backtracking issue. The apply method is the entry point for this vulnerable logic, as it sets up the callback containing the problematic regex execution.