GitHub Advisoryadvisory · npm

GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service

HIGH Published 2023-06-21 Modified 2026-02-04 Official page ↗
Aliases
CVE-2022-25883
Ecosystem
npm
Packages
semver
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2023-06-22

Affected packages

• npm semver: >= 7.0.0, < 7.5.2 → fixed in 7.5.2 • npm semver: >= 6.0.0, < 6.3.1 → fixed in 6.3.1 • npm semver: >= 2.0.0-alpha, < 5.7.2 → fixed in 5.7.2

Description

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Related

Alias · CVE (1)

  • CVE-2022-25883 Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References