Vulnerability Description
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS Score
5.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Npmjs | Semver | < 5.7.2 |
Related Weaknesses (CWE)
References
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104Broken Link
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138Broken Link
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160Broken Link
- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d44PatchThird Party Advisory
- https://github.com/npm/node-semver/pull/564PatchThird Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795ExploitPatchThird Party Advisory
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104Broken Link
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138Broken Link
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160Broken Link
- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d44PatchThird Party Advisory
- https://github.com/npm/node-semver/pull/564PatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20241025-0004/Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795ExploitPatchThird Party Advisory
FAQ
What is CVE-2022-25883?
CVE-2022-25883 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
How severe is CVE-2022-25883?
CVE-2022-25883 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-25883?
Check the references section above for vendor advisories and patch information. Affected products include: Npmjs Semver.