Packages / semver / Security

HighVulnerabilityGHSA-x6fg-f45m-jf5qCVE-2015-8855Published 24 Oct 2017

Regular Expression Denial of Service in semver

Your version

Affected releases · semver

  • 4.x4.0.0 – 4.3.1Fixed in 4.3.2
  • 3.x and older1.0.4 – 3.0.1No fix, no longer updated

On 4.x, the newest line:

npm install semver@4.3.2
Every release on a timeline
7.x

  1. Not affected

    7.0.0 – 7.8.5

    39 releases, latest

4.x

  1. Affected

    4.0.0 – 4.3.1

    10 releases

  2. Fixed

    4.3.2 – 4.3.6

    5 releases

3.x

  1. Affected

    3.0.0 – 3.0.1

    2 releases

2.x

  1. Affected

    2.0.1 – 2.3.2

    17 releases

1.x

  1. Not affected

    1.0.0 – 1.0.3

    4 releases

  2. Affected

    1.0.4 – 1.1.4

    16 releases

117 stable releases of semver, oldest to newest, one row per major.

What happens

Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

Recommendation

Update to version 4.3.2 or later