GitHub Advisoryadvisory · npm

GHSA-44c6-4v22-4mhx semver-regex Regular Expression Denial of Service (ReDOS)

HIGH Published 2021-09-20 Modified 2023-07-11 Official page ↗

Aliases: CVE-2021-3795
Ecosystem: npm
Packages: semver-regex
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-1333, CWE-400
Reviewed: 2021-09-16

Affected packages

• npm semver-regex: < 3.1.3 → fixed in 3.1.3 • npm semver-regex: >= 4.0.0, < 4.0.1 → fixed in 4.0.1

Description

npm `semver-regex` is vulnerable to Inefficient Regular Expression Complexity

Related

Alias · CVE (1)

CVE-2021-3795 semver-regex is vulnerable to Inefficient Regular Expression Complexity vulnerability

Weakness · CWE (2)

CWE-1333 Inefficient Regular Expression Complexity weakness
CWE-400 Uncontrolled Resource Consumption weakness

References