babel @babel/runtime-corejs2 vulnerabilities

Latest babel @babel/runtime-corejs2 CVEs

Newest publication first

1. CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

   Published 2026-08-07

   Medium·CVSS 6.2

   Impact When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to .replace). Your generated code is vu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.