Medium
node-babel, node-babel7 — security advisory
Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.
- Products
- node-babel, node-babel7
- Affected versions
- 6.26.0+dfsg-3build5, 6.26.0+dfsg-3build6, 6.26.0+repack-2, 6.26.0+repack-3, 7.12.12+~cs150.141.84-6, 7.12.12+~cs150.141.84-7, 7.12.12+~cs150.141.84-8, 7.20.15+ds1+~cs214.269.168-11build1, 7.20.15+ds1+~cs214.269.168-14, 7.20.15+ds1+~cs214.269.168-16, 7.20.15+ds1+~cs214.269.168-17build1, 7.20.15+ds1+~cs214.269.168-17build2, 7.20.15+ds1+~cs214.269.168-18, 7.20.15+ds1+~cs214.269.168-4, 7.20.15+ds1+~cs214.269.168-5, 7.20.15+ds1+~cs214.269.168-6, 7.20.15+ds1+~cs214.269.168-6build1, 7.20.15+ds1+~cs214.269.168-8, 7.20.15+ds1+~cs214.269.168-9
- Fixed versions
- Not specified
- CVEs
- CVE-2025-27789
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:26 UTC · Revision 1
Source evidence
Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.
osv:UBUNTU-CVE-2025-27789
node-babel
Fixed versions: Not specified
node-babel
Fixed versions: Not specified
node-babel7
Fixed versions: Not specified
node-babel7
Fixed versions: Not specified
node-babel7
Fixed versions: Not specified
node-babel7
Fixed versions: Not specified
node-babel7
Fixed versions: Not specified
Complete source record
{
"id": "c46ba812cd88c0673727e3eda555930e800195fa0df12908e0003d39810c998a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-27789",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2025-27789",
"summary": "Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.",
"evidence": "osv:UBUNTU-CVE-2025-27789",
"products": [
{
"name": {
"value": "node-babel",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.26.0+dfsg-3build5",
"evidence": "/affected/0/versions"
},
{
"value": "6.26.0+dfsg-3build6",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "node-babel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.26.0+dfsg-3build6",
"evidence": "/affected/1/versions"
},
{
"value": "6.26.0+repack-2",
"evidence": "/affected/1/versions"
},
{
"value": "6.26.0+repack-3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "node-babel7",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.12.12+~cs150.141.84-6",
"evidence": "/affected/2/versions"
},
{
"value": "7.12.12+~cs150.141.84-7",
"evidence": "/affected/2/versions"
},
{
"value": "7.12.12+~cs150.141.84-8",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "node-babel7",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.20.15+ds1+~cs214.269.168-4",
"evidence": "/affected/3/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-5",
"evidence": "/affected/3/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-6",
"evidence": "/affected/3/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-6build1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "node-babel7",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.20.15+ds1+~cs214.269.168-8",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "node-babel7",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.20.15+ds1+~cs214.269.168-16",
"evidence": "/affected/5/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-17build1",
"evidence": "/affected/5/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-17build2",
"evidence": "/affected/5/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-18",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "node-babel7",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.20.15+ds1+~cs214.269.168-8",
"evidence": "/affected/6/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-9",
"evidence": "/affected/6/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-11build1",
"evidence": "/affected/6/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-14",
"evidence": "/affected/6/versions"
},
{
"value": "7.20.15+ds1+~cs214.269.168-16",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2025-27789",
"aliases": [
"UBUNTU-CVE-2025-27789"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-babel",
"purl": "pkg:deb/ubuntu/node-babel?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"6.26.0+dfsg-3build5",
"6.26.0+dfsg-3build6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27789.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-babel-cli",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-code-frame",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-core",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-generator",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-bindify-decorators",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-builder-binary-assignment-operator-visitor",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-builder-react-jsx",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-call-delegate",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-define-map",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-explode-assignable-expression",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-explode-class",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-function-name",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-get-function-arity",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-hoist-variables",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-optimise-call-expression",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-regex",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-remap-async-to-generator",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helper-replace-supers",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-helpers",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-messages",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-external-helpers",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-async-functions",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-async-generators",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-class-constructor-call",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-class-properties",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-decorators",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-do-expressions",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-dynamic-import",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-exponentiation-operator",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-export-extensions",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-flow",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-function-bind",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-jsx",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-object-rest-spread",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-syntax-trailing-function-commas",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-async-generator-functions",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-async-to-generator",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-class-constructor-call",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-class-properties",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-decorators",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-do-expressions",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-es3-member-expression-literals",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-es3-property-literals",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-exponentiation-operator",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-export-extensions",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-flow-strip-types",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-function-bind",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-jscript",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-object-rest-spread",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-proto-to-assign",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-react-display-name",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-react-jsx",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-react-jsx-self",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-react-jsx-source",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-regenerator",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-runtime",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-plugin-transform-strict-mode",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-polyfill",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-es2015",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-es2016",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-es2017",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-flow",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-latest",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-react",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-stage-0",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-stage-1",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-stage-2",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-preset-stage-3",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-register",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-runtime",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-template",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-traverse",
"binary_version": "6.26.0+dfsg-3build6"
},
{
"binary_name": "node-babel-types",
"binary_version": "6.26.0+dfsg-3build6"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-babel",
"purl": "pkg:deb/ubuntu/node-babel?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"6.26.0+dfsg-3build6",
"6.26.0+repack-2",
"6.26.0+repack-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27789.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-babel-cli",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-code-frame",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-core",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-generator",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-bindify-decorators",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-builder-binary-assignment-operator-visitor",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-builder-react-jsx",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-call-delegate",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-define-map",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-explode-assignable-expression",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-explode-class",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-function-name",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-get-function-arity",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-hoist-variables",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-optimise-call-expression",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-regex",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-remap-async-to-generator",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helper-replace-supers",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-helpers",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-messages",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-external-helpers",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-async-functions",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-async-generators",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-class-constructor-call",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-class-properties",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-decorators",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-do-expressions",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-dynamic-import",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-exponentiation-operator",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-export-extensions",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-flow",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-function-bind",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-jsx",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-object-rest-spread",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-syntax-trailing-function-commas",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-async-generator-functions",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-async-to-generator",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-class-constructor-call",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-class-properties",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-decorators",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-do-expressions",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-es3-member-expression-literals",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-es3-property-literals",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-exponentiation-operator",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-export-extensions",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-flow-strip-types",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-function-bind",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-jscript",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-object-rest-spread",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-proto-to-assign",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-react-display-name",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-react-jsx",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-react-jsx-self",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-react-jsx-source",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-regenerator",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-runtime",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-plugin-transform-strict-mode",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-polyfill",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-es2015",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-es2016",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-es2017",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-flow",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-latest",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-react",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-stage-0",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-stage-1",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-stage-2",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-preset-stage-3",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-register",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-runtime",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-template",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-traverse",
"binary_version": "6.26.0+repack-3"
},
{
"binary_name": "node-babel-types",
"binary_version": "6.26.0+repack-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-babel7",
"purl": "pkg:deb/ubuntu/node-babel7?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"7.12.12+~cs150.141.84-6",
"7.12.12+~cs150.141.84-7",
"7.12.12+~cs150.141.84-8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27789.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-babel7",
"binary_version": "7.12.12+~cs150.141.84-8"
},
{
"binary_name": "node-babel7-runtime",
"binary_version": "7.12.12+~cs150.141.84-8"
},
{
"binary_name": "node-babel7-standalone",
"binary_version": "7.12.12+~cs150.141.84-8"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-babel7",
"purl": "pkg:deb/ubuntu/node-babel7?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"7.20.15+ds1+~cs214.269.168-4",
"7.20.15+ds1+~cs214.269.168-5",
"7.20.15+ds1+~cs214.269.168-6",
"7.20.15+ds1+~cs214.269.168-6build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27789.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-babel7",
"binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
},
{
"binary_name": "node-babel7-debug",
"binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
},
{
"binary_name": "node-babel7-runtime",
"binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
},
{
"binary_name": "node-babel7-standalone",
"binary_version": "7.20.15+ds1+~cs214.269.168-6build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-babel7",
"purl": "pkg:deb/ubuntu/node-babel7?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"7.20.15+ds1+~cs214.269.168-8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27789.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-babel7",
"binary_version": "7.20.15+ds1+~cs214.269.168-8"
},
{
"binary_name": "node-babel7-debug",
"binary_version": "7.20.15+ds1+~cs214.269.168-8"
},
{
"binary_name": "node-babel7-runtime",
"binary_version": "7.20.15+ds1+~cs214.269.168-8"
},
{
"binary_name": "node-babel7-standalone",
"binary_version": "7.20.15+ds1+~cs214.269.168-8"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-babel7",
"purl": "pkg:deb/ubuntu/node-babel7?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"7.20.15+ds1+~cs214.269.168-16",
"7.20.15+ds1+~cs214.269.168-17build1",
"7.20.15+ds1+~cs214.269.168-17build2",
"7.20.15+ds1+~cs214.269.168-18"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27789.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-babel7",
"binary_version": "7.20.15+ds1+~cs214.269.168-18"
},
{
"binary_name": "node-babel7-debug",
"binary_version": "7.20.15+ds1+~cs214.269.168-18"
},
{
"binary_name": "node-babel7-runtime",
"binary_version": "7.20.15+ds1+~cs214.269.168-18"
},
{
"binary_name": "node-babel7-standalone",
"binary_version": "7.20.15+ds1+~cs214.269.168-18"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-babel7",
"purl": "pkg:deb/ubuntu/node-babel7?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"7.20.15+ds1+~cs214.269.168-8",
"7.20.15+ds1+~cs214.269.168-9",
"7.20.15+ds1+~cs214.269.168-11build1",
"7.20.15+ds1+~cs214.269.168-14",
"7.20.15+ds1+~cs214.269.168-16"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-27789.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-babel7",
"binary_version": "7.20.15+ds1+~cs214.269.168-16"
},
{
"binary_name": "node-babel7-debug",
"binary_version": "7.20.15+ds1+~cs214.269.168-16"
},
{
"binary_name": "node-babel7-runtime",
"binary_version": "7.20.15+ds1+~cs214.269.168-16"
},
{
"binary_name": "node-babel7-standalone",
"binary_version": "7.20.15+ds1+~cs214.269.168-16"
}
]
}
}
],
"modified": "2026-10-17T12:56:49.554121168Z",
"provider": "osv",
"upstream": [
"CVE-2025-27789"
],
"references": [
"https://ubuntu.com/security/CVE-2025-27789",
"https://www.cve.org/CVERecord?id=CVE-2025-27789",
"https://github.com/babel/babel/pull/17173",
"https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"
]
},
"related_cves": [
{
"value": "CVE-2025-27789",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 356400,
"published_at": "2025-03-11T20:15:00+00:00"
}