Regular expression denial of service in semver-regex

Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

Recommendation

Update the semver-regex package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0, < 4.0.3

  < 3.1.4**

• Patched version(s): **4.0.3

  3.1.4**

References

• GHSA-4x5v-gmq8-25ch
• research.jfrog.com
• CVE-2021-43307
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• semver-regex Regular Expression Denial of Service (ReDOS) - CVE-2021-3795
• html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
• Regular expression Denial of Service in multiple packages - CVE-2021-21391
• Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-widget - CVE-2021-21391

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

semver-regex