HIGH 7.5 npm
Regular Expression Denial of Service in semver
GHSA-x6fg-f45m-jf5q · CVE-2015-8855
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Recommendation
Update to version 4.3.2 or later
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2015-8855
- WEB https://github.com/github/advisory-database/pull/7102
- WEB https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0
- WEB https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70
- ADVISORY https://github.com/advisories/GHSA-x6fg-f45m-jf5q
- PACKAGE https://github.com/npm/node-semver
- WEB https://www.npmjs.com/advisories/31
- WEB https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
- WEB http://www.openwall.com/lists/oss-security/2016/04/20/11
- WEB http://www.securityfocus.com/bid/86957
Ready to move
Start Securing
Free, no credit card | First findings in minutes