GHSA-c2qf-rxjj-qqgw
- Severity
- High
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA KEV
- Not in the cached KEV catalog
- EPSS
- No cached EPSS score
Affected and fixed versions
- Introduced 7.0.0 · fixed in 7.5.2
- Introduced 6.0.0 · fixed in 6.3.1
- Introduced 2.0.0-alpha · fixed in 5.7.2
The latest published version is not inside an affected range, or OSV lists no fix for it.
Plain-language text is shown only when it is already cached. This page does not generate it.
semver vulnerable to Regular Expression Denial of Service
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Aliases: CVE-2022-25883
Advisory on OSV.dev · published 2023-06-21 · modified 2026-09-10
- https://nvd.nist.gov/vuln/detail/CVE-2022-25883
- https://github.com/npm/node-semver/pull/564
- https://github.com/npm/node-semver/pull/585
- https://github.com/npm/node-semver/pull/593
- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0
- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441