GitHub Advisoryadvisory · npm
GHSA-4x5v-gmq8-25ch Regular expression denial of service in semver-regex
LOW
Official page ↗
- Aliases
- CVE-2021-43307
- Ecosystem
- npm
- Packages
- semver-regex
- Severity
- Low
- Weaknesses
- CWE-1333
- Reviewed
- 2022-06-03
Affected packages
• npm semver-regex: < 3.1.4 → fixed in 3.1.4
• npm semver-regex: >= 4.0.0, < 4.0.3 → fixed in 4.0.3
Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Related
Alias · CVE (1)
- CVE-2021-43307 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to… vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness