CVE-2022-25883: semver Regular Expression Denial of Service
Summary
CVE-2022-25883: semver vulnerable to Regular Expression Denial of Service. Affects semver across 3 version ranges.
< 5.7.2
>= 6.0.0, < 6.3.1
>= 7.0.0, < 7.5.2
Fixed in 5.7.2, 6.3.1 or 7.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- node-semver · Debian:11
The same CVE-2022-25883 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
semver is an npm package that provides a utility for parsing and comparing semantic version numbers. It is widely used in JavaScript projects to handle versioning and dependency management. However, versions of semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This vulnerability arises when untrusted user data is provided as a range to the 'new Range' function.
Vulnerability Detail
The vulnerability in semver allows an attacker to exploit the regular expression used in the 'new Range' function, leading to a Denial of Service (DoS) attack. By providing specially crafted input, an attacker can cause the regular expression matching to take an excessive amount of time, resulting in a significant performance degradation or even a complete system freeze. This can be exploited by an attacker to disrupt the availability of a system or service.
How To Fix
Latest published version: 7.8.5 as of 22 Oct 2026
npm install semver@7.8.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.7.25.7.2npm install semver@5.7.2 -
>= 6.0.0, < 6.3.16.3.1npm install semver@6.3.1 -
>= 7.0.0, < 7.5.27.5.2npm install semver@7.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by validating user input before passing it to the 'new Range' function. This can be done by implementing input sanitization and limiting the complexity of the input range. Here's an example of how to sanitize user input in JavaScript:
const semver = require('semver');
function sanitizeRange(range) {
// Perform input sanitization
// Limit the complexity of the range
// Return the sanitized range
return range;
}
const userRange = sanitizeRange(userInput);
const versionRange = new semver.Range(userRange);
By sanitizing the user input, the risk of a ReDoS attack can be mitigated.
Conclusion
The semver package is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. To mitigate this vulnerability, it is crucial to update the package to the fixed versions or implement input sanitization as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for semver →
FAQ
semver is an npm package used for parsing and comparing semantic version numbers. It provides a convenient way to work with versioning in JavaScript projects.
Regular Expression Denial of Service (ReDoS) is a type of vulnerability that arises when a regular expression pattern can be exploited to cause excessive backtracking, leading to a significant performance degradation or system freeze.
The semver vulnerability can be exploited by providing specially crafted input as a range to the 'new Range' function. This can cause the regular expression matching to take an excessive amount of time, leading to a Denial of Service (DoS) attack.
The semver vulnerability can result in a significant performance degradation or even a complete system freeze. This can be exploited by an attacker to disrupt the availability of a system or service.
To fix the semver vulnerability, it is recommended to update the semver package to the fixed versions: 7.5.2 for the 7.x branch, 6.3.1 for the 6.x branch, or 5.7.2 for older versions. Updating to these versions eliminates the vulnerable regular expression and mitigates the risk of a Denial of Service (DoS) attack.
References
Related vulnerabilities
Recent vulnerabilities recorded for semver.
