Post

Babel
@babel.dev

We just released Babel v7.26.10 and v8.0.0-alpha.17, with a security fix that affects transpilation of regular expressions. Make sure to update! github.com/babel/babel/...

github.comInefficient RexExp complexity in generated code with .replace when transpiling named capturing groups### Impact When using Babel to compile [regular expression named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group), B...
Babel
@babel.dev

It is unlikely that you are affected, as the security vulnerability only applies when passing a user-provided string to the second argument of RegExp.prototype.replace.

0 reposts2 likes

Babel
@babel.dev

We apologize to all the maintainers of libraries that depend on @babel/runtime, do not actually trigger the vulnerable code path, and will get bug reports asking to "please upgrade Babel because it's insecure" 😅

Nicolò Ribaudo
@nicr.dev

It would be a shame if they just spammed everybody, wouldn't it? So lucky we have technology now, that could be used to solve technical problems