react-native-reanimated vulnerable to ReDoS

ALTO 7.5CVE-2022-24373 · GHSA-2j79-8pqc-r7x6 · Published 30/09/2022 · updated 17/06/2026

In breve

CVE-2022-24373 è una vulnerabilità ALTO (CVSS 7.5) che riguarda react native reanimated (swmansion), react-native-reanimated.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 76.5% delle vulnerabilità.
Correzione: aggiornare a 2.10.0 o successiva.

Package	Affected versions	Patched versions
react native reanimated swmansion	`< 2.10.0`	`2.10.0`
react-native-reanimated npm	`< 2.10.0`	`2.10.0`

Description

The package react-native-reanimated before 2.10.0 is vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.

NVD description

The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.

References

nvd.nist.gov/vuln/detail/CVE-2022-24373 · ADVISORY
software-mansion/react-native-reanimated#3382 · WEB
software-mansion/react-native-reanimated#3382 · WEB
software-mansion/react-native-reanimated commit 8a92790 · WEB
software-mansion/react-native-reanimated · PACKAGE
software-mansion/react-native-reanimated · WEB
software-mansion/react-native-reanimated release 3.0.0-rc.1 · WEB
security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free