CVE-2021-3795: semver-regex Regular Expression Denial of Service (ReDOS)
Summary
CVE-2021-3795: semver-regex Regular Expression Denial of Service (ReDOS). Affects semver-regex across 2 version ranges.
< 3.1.3
>= 4.0.0, < 4.0.1
Fixed in 3.1.3 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The semver-regex package is an npm package used for parsing and validating semantic version strings. It provides regular expressions for matching and extracting version components. This package is commonly used in JavaScript projects to handle versioning. However, versions prior to 3.1.3 and 4.0.1 are vulnerable to an Inefficient Regular Expression Complexity issue, which can lead to Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability in semver-regex arises from inefficient regular expressions, which can be exploited to cause a Denial of Service (DoS) attack. An attacker can craft a specially crafted version string that triggers excessive backtracking in the regular expression engine, causing the application to consume excessive CPU resources and potentially crash. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.33.1.3npm install semver-regex@3.1.3 -
>= 4.0.0, < 4.0.14.0.1npm install semver-regex@4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the semver-regex package to the fixed versions.
Conclusion
The semver-regex package is vulnerable to an Inefficient Regular Expression Complexity issue, which can lead to Denial of Service (DoS) attacks. It is crucial to update the package to the fixed versions to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for semver-regex →
FAQ
This vulnerability can lead to a Denial of Service (DoS) attack, causing the application to consume excessive CPU resources and potentially crash.
Versions prior to 3.1.3 and versions 4.0.0 to 4.0.1 of semver-regex are affected.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
No, there are no known workarounds for this vulnerability. It is crucial to update the semver-regex package to the fixed versions.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-44c6-4v22-4mhx/GHSA-44c6-4v22-4mhx.json
Related vulnerabilities
Recent vulnerabilities recorded for semver-regex.
