GitHub Advisoryadvisory · npm
GHSA-x6fg-f45m-jf5q Regular Expression Denial of Service in semver
HIGH
Official page ↗
- Aliases
- CVE-2015-8855
- Ecosystem
- npm
- Packages
- semver
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2020-06-16
Affected packages
• npm semver: >= 1.0.4, < 4.3.2 → fixed in 4.3.2
Description
Versions 4.3.1 and earlier of `semver` are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Recommendation
Update to version 4.3.2 or later
Related
Alias · CVE (1)
- CVE-2015-8855 The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka… vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-8855 advisory
- https://github.com/github/advisory-database/pull/7102 web
- https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0 web
- https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70 web
- https://github.com/advisories/GHSA-x6fg-f45m-jf5q advisory
- https://github.com/npm/node-semver package
- https://www.npmjs.com/advisories/31 web
- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS web
- http://www.openwall.com/lists/oss-security/2016/04/20/11 web
- http://www.securityfocus.com/bid/86957 web