Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Recommendation
Update the semver-regex package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.0.3 < 3.1.4** Patched version(s): **4.0.3 3.1.4**
References
Could your website be exposed too?
SmartScanner can check your website for Regular expression denial of service in semver-regex and gives you actionable findings to investigate.
Start a free scanRelated Issues
- semver-regex Regular Expression Denial of Service (ReDOS) - CVE-2021-3795
- html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
- Regular expression Denial of Service in multiple packages - CVE-2021-21391
- Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-widget - CVE-2021-21391
You might also like:
See something that needs correcting? Let us knowUpdated July 19, 2023