semver vulnerable to Regular Expression Denial of Service

ÉLEVÉE 7.5CVE-2022-25883 · GHSA-c2qf-rxjj-qqgw · Published 21/06/2023 · updated 17/06/2026

En bref

CVE-2022-25883 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant semver (npmjs), semver.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.8%, plus élevée que 86.3% des vulnérabilités.
Correctif : mettre à jour vers 6.3.1, 7.5.3, 5.7.2, 7.5.2 ou plus récent.

Package	Affected versions	Patched versions
semver npmjs	`≥ 6.0.0, < 6.3.1≥ 7.0.0, < 7.5.3< 5.7.2`	`6.3.17.5.35.7.2`
semver npm	`≥ 2.0.0-alpha, < 5.7.2≥ 6.0.0, < 6.3.1≥ 7.0.0, < 7.5.2`	`5.7.26.3.17.5.2`

Description

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

NVD description

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

References

nvd.nist.gov/vuln/detail/CVE-2022-25883 · ADVISORY
npm/node-semver#564 · WEB
npm/node-semver#585 · WEB
npm/node-semver#593 · WEB
npm/node-semver commit 2f8fd41 · WEB
npm/node-semver commit 717534e · WEB
npm/node-semver commit 928e56d · WEB
npm/node-semver · PACKAGE
npm/node-semver · WEB
npm/node-semver · WEB
npm/node-semver · WEB
npm/node-semver · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

semver

npmjs

≥ 6.0.0, < 6.3.1≥ 7.0.0, < 7.5.3< 5.7.2

6.3.17.5.35.7.2

semver

npm

≥ 2.0.0-alpha, < 5.7.2≥ 6.0.0, < 6.3.1≥ 7.0.0, < 7.5.2

5.7.26.3.17.5.2

Description

NVD description

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.