7.5

CVE-2022-37620: kangax html-minifier

CVSS: 7.5v3.1HighModified
AliasesCGA-4rc5-45fp-4c7pCGA-6r7p-p7rc-3qc4CGA-p6qw-c75h-cjv9
Published 31-10-2022Last modified 01-06-2025
Open JSON

Vulnerability summary

CVE-2022-37620 is a high (CVSS 7.5) vulnerability in kangax html-minifier. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 66.8% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.17%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-5J8M-J65X-F87GCGA-MVV3-XJV4-W9GC

Timeline

  1. 31-10-2022
    PublishedVulnerability first disclosed.
  2. 01-06-2025
    Last modifiedVulnerability information updated.

Description

A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

1.17%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

+0.01 pp

From 1.15% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • jitsucom-jitsu< 2.8.4-r0
  • jitsucom-jitsu-console< 2.8.4-r0
  • jitsucom-jitsu-rotor< 2.8.4-r0
Wolfi3 products
  • jitsucom-jitsu< 2.8.4-r0
  • jitsucom-jitsu-console< 2.8.4-r0
  • jitsucom-jitsu-rotor< 2.8.4-r0
Kangax1 product
Npm1 product
  • html-minifier≤ 4.0.0
Terser1 product

5 vendors · 9 products

References

7 links