babel @babel/runtime-corejs3 vulnerabilities

Latest babel @babel/runtime-corejs3 CVEs

Newest publication first

1. CVE-2025-27789 Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

   Published 2025-03-11

   Medium·CVSS 6.2 EPSS 0.56%

   Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.