CVE-2022-25883

The semver package before version 7.5.2 has a flaw where it can be made to hang or crash when processing certain malformed version range strings. An attacker can exploit this by sending specially crafted input to cause a denial of service.

A ReDoS vulnerability exists in the Range constructor of semver <7.5.2, exploitable via untrusted range input strings that trigger excessive backtracking in regular expression evaluation. The vulnerability requires application code to process attacker-controlled range parameters, resulting in CPU exhaustion and service unavailability.