Packages / semver / Security

HighVulnerabilityGHSA-c2qf-rxjj-qqgwCVE-2022-25883Published 21 Jun 2023

semver vulnerable to Regular Expression Denial of Service

Your version

Affected releases · semver

  • 7.x7.0.0 – 7.5.1Fixed in 7.5.2
  • 6.x6.0.0 – 6.3.0Fixed in 6.3.1
  • 5.x5.0.0 – 5.7.1Fixed in 5.7.2
  • 4.x and older2.0.1 – 4.3.6No fix, no longer updated

On 7.x, the newest line:

npm install semver@7.5.2
Every release on a timeline
7.x

  1. Affected

    7.0.0 – 7.5.1

    21 releases

  2. Fixed

    7.5.2 – 7.8.5

    18 releases, latest

6.x

  1. Affected

    6.0.0 – 6.3.0

    7 releases

  2. Fixed

    6.3.1

    1 release

5.x

  1. Affected

    5.0.0 – 5.7.1

    15 releases

  2. Fixed

    5.7.2

    1 release

4.x

  1. Affected

    4.0.0 – 4.3.6

    15 releases

3.x

  1. Affected

    3.0.0 – 3.0.1

    2 releases

2.x

  1. Affected

    2.0.1 – 2.3.2

    17 releases

117 stable releases of semver, oldest to newest, one row per major.

What happens

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.