Denial of Service Vulnerability in node-semver
Summary
CVE-2015-8855: The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS).". Affects node-semver versions < 5.3.0-1. Fixed in 5.3.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-semver is a package for Node.js that provides a utility for parsing and comparing semantic version strings. It is commonly used in Node.js applications to handle versioning and dependency management. However, an issue has been discovered in versions before 4.3.2 that allows attackers to cause a denial of service (CPU consumption) by providing a long version string. This vulnerability is classified as a regular expression denial of service (ReDoS) attack.
Vulnerability Detail
The vulnerability arises from the way the semver package handles parsing of version strings. By providing a long and complex version string, an attacker can trigger a ReDoS attack, causing the application to consume excessive CPU resources and potentially leading to a denial of service. This can impact the availability and performance of the affected application.
How To Fix
Minimum fixed version
5.3.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-semverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The node-semver package before version 4.3.2 is vulnerable to a denial of service attack. It is crucial to update the package to the fixed version to mitigate the risk. No known workaround is available for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-semver →
FAQ
node-semver is a package for Node.js that provides a utility for parsing and comparing semantic version strings. It is commonly used in Node.js applications for versioning and dependency management.
A ReDoS (Regular Expression Denial of Service) attack is a type of denial of service attack that exploits the way regular expressions are processed. By providing a specially crafted input, an attacker can cause the regular expression matching algorithm to take an excessive amount of time, leading to a denial of service.
This vulnerability can lead to a denial of service, causing the affected application to consume excessive CPU resources and impacting its availability and performance.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in fixing the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for node-semver.
