semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-25883US | high7.5 | — | ||
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a ran… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/npm/node-semverPACKAGE
- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104WEB
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js#L138WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js#L160WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138WEB
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160WEB
- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan