CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2022-25883
High (7.5) in npmjs semver. EPSS 2.8% chance of exploitation in the next 30 days. Fixed in semver 5.7.2, 6.3.1, 7.5.2.
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Severity
- EPSS
- 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Affected
- npmjs:semver
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c2qf-rxjj-qqgw | npm | semver | >=7.0.0 <7.5.2 | 7.5.2 |
| GHSA-c2qf-rxjj-qqgw | npm | semver | >=6.0.0 <6.3.1 | 6.3.1 |
| GHSA-c2qf-rxjj-qqgw | npm | semver | >=2.0.0-alpha <5.7.2 | 5.7.2 |
References
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
- https://github.com/npm/node-semver/pull/564