What’s Vulnerable › Vulnerabilities

CVE-2022-25883: semver vulnerable to Regular Expression Denial of Service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-21 · updated 2026-06-17
• Weakness: CWE-1333

Description

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Affected products

• semver: before 5.7.2; from 6.0.0 before 6.3.1; from 7.0.0 before 7.5.3 — fixed in 5.7.2, 6.3.1, 7.5.3
• Npm Semver: from 7.0.0 before 7.5.2; from 6.0.0 before 6.3.1; from 2.0.0-alpha before 5.7.2 — fixed in 7.5.2, 6.3.1, 5.7.2

How to fix

Upgrade to a fixed version: semver 5.7.2, 6.3.1, 7.5.3; Npm Semver 7.5.2, 6.3.1, 5.7.2. Check the vendor advisory for mitigations.

References

• https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
• https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
• https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
• https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
• https://github.com/npm/node-semver/pull/564
• https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
• https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
• https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
• https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
• https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
• https://github.com/npm/node-semver/pull/564
• https://security.netapp.com/advisory/ntap-20241025-0004/

Get alerted when CVE-2022-25883 or the next vulnerability affects your stack