CVE-2022-25881: 
JavaScript vulnerability analysis and mitigation

CVE-2022-25881 affects versions of the package http-cache-semantics before 4.1.1. The vulnerability is a Regular Expression Denial of Service (ReDoS) that can be exploited via malicious request header values sent to a server when that server reads the cache policy from the request using this library (NVD, Snyk).

The vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity). It has received a CVSS v3.1 base score of 7.5 (HIGH) from NVD with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while Snyk rates it at 5.3 (MEDIUM). The issue stems from catastrophic backtracking in regular expression processing, where the number of processing steps grows exponentially with input size (Snyk).

When successfully exploited, this vulnerability can lead to Denial of Service (DoS) by causing excessive CPU consumption. The attack can make the service either partially available or intermittently unavailable, though the attacker cannot achieve complete denial of service (NetApp, Snyk).

The recommended mitigation is to upgrade http-cache-semantics to version 4.1.1 or higher. No alternative workarounds have been identified (Snyk).