GHSA-x6fg-f45m-jf5qHighCVSS 7.5
Regular Expression Denial of Service in semver
🔗 CVE IDs covered (1)
📋 Description
Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Recommendation
Update to version 4.3.2 or later
🎯 Affected products1
- npm/semver:>= 1.0.4, < 4.3.2
🔗 References (9)
- https://nvd.nist.gov/vuln/detail/CVE-2015-8855
- https://github.com/advisories/GHSA-x6fg-f45m-jf5q
- https://www.npmjs.com/advisories/31
- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
- http://www.openwall.com/lists/oss-security/2016/04/20/11
- http://www.securityfocus.com/bid/86957
- https://github.com/github/advisory-database/pull/7102
- https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0
- https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70