VDB
KO
HIGH 7.5

GHSA-c2qf-rxjj-qqgw

semver vulnerable to Regular Expression Denial of Service

Quick fix

GHSA-c2qf-rxjj-qqgw — semver: upgrade to the fixed version with the command below. 

npm install semver@7.5.2

Details

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / semver
Introduced in: 7.0.0 Fixed in: 7.5.2
Fix npm install semver@7.5.2
npm / semver
Introduced in: 6.0.0 Fixed in: 6.3.1
Fix npm install semver@6.3.1
npm / semver
Introduced in: 2.0.0-alpha Fixed in: 5.7.2
Fix npm install semver@5.7.2

References