Critical Regular Expression Denial of Service Vulnerability in node-semver Package
Summary
DEBIAN-CVE-2022-25883: Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range. Affects node-semver versions < 7.5.4+~7.5.0-1. Fixed in 7.5.4+~7.5.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-semver package is a widely used library in the JavaScript ecosystem that provides semantic versioning utilities. It allows developers to manage and compare version numbers effectively, ensuring compatibility and dependency management in their applications. However, certain versions of this package are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can be exploited when untrusted user data is processed as a range.
Vulnerability Detail
Versions of the node-semver package prior to 7.5.2 are susceptible to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability arises from the function 'new Range', which can be exploited when untrusted user input is provided. An attacker can craft specific input that causes excessive backtracking in the regular expression engine, leading to significant performance degradation or application crashes. This can result in denial of service, affecting the availability of the application that relies on this package.
How To Fix
Minimum fixed version
7.5.4+~7.5.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-semverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted user data with the node-semver package until it can be updated. Implement input validation to sanitize user inputs before they are passed to the 'new Range' function.
Conclusion
The node-semver package has a critical vulnerability that can lead to Regular Expression Denial of Service attacks. It is crucial for developers using this package to update to the fixed version 7.5.4+~7.5.0-1 to ensure the security and stability of their applications. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for node-semver →
FAQ
ReDoS is a type of denial of service attack that exploits the way regular expressions are processed. By providing specially crafted input, an attacker can cause the regex engine to consume excessive amounts of CPU time, leading to application slowdowns or crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can quickly determine if your application is at risk.
If exploited, this vulnerability can lead to application downtime, degraded performance, and a poor user experience. It may also expose the application to further attacks if not addressed promptly.
Yes, you can implement input validation to sanitize any user inputs before they are processed by the node-semver package. This can help reduce the risk of exploitation until the package is updated.
You can find detailed documentation and resources for the node-semver package on its official repository or npm page, which provides insights into its functionality and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-semver.
