CVE-2022-25883mediumCWE-1333

CVE-2022-25883: medium-severity vulnerability in semver

Published · Updated

Follow this CVE+ Monitor semver+ Monitor node-semver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 2.8%
In short

The semver package before version 7.5.2 has a flaw where it can be made to hang or crash when processing certain malformed version range strings. An attacker can exploit this by sending specially crafted input to cause a denial of service.

Technical detail

A ReDoS vulnerability exists in the Range constructor of semver <7.5.2, exploitable via untrusted range input strings that trigger excessive backtracking in regular expression evaluation. The vulnerability requires application code to process attacker-controlled range parameters, resulting in CPU exhaustion and service unavailability.

Summary generated and translated by AI from the official description.
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Affected products
n/a · semver