semver-regex Regular Expression Denial of Service (ReDOS)

Description

npm semver-regex is vulnerable to Inefficient Regular Expression Complexity

Recommendation

Update the semver-regex package to the latest compatible version. Followings are version details:

• Affected version(s): **= 4.0.0

  < 3.1.3**

• Patched version(s): **4.0.1

  3.1.3**

References

• GHSA-44c6-4v22-4mhx
• huntr.dev
• CVE-2021-3795
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular expression denial of service in semver-regex - CVE-2021-43307
• Regular Expression Denial of Service (ReDoS) in ua-parser-js - CVE-2021-27292
• Regular Expression Denial of Service (ReDoS) - ssri - CVE-2021-27290
• Regular Expression Denial of Service (ReDOS) - color-string - CVE-2021-29060

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

semver-regex