NodeJS/semver/5.2.0
The semantic version parser used by npm.
https://www.npmjs.com/package/semver
ISC
1 Security Vulnerabilities
semver vulnerable to Regular Expression Denial of Service
Published date: 2023-06-21T06:30:28Z
CVE: CVE-2022-25883
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2022-25883
- https://github.com/npm/node-semver/pull/564
- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104
- https://github.com/npm/node-semver/blob/main/internal/re.js#L138
- https://github.com/npm/node-semver/blob/main/internal/re.js#L160
- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
- https://github.com/npm/node-semver/pull/585
- https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c
- https://github.com/npm/node-semver/pull/593
- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Affected versions:
["7.0.0", "7.1.0", "7.1.1", "7.1.2", "7.1.3", "7.2.0", "7.2.1", "7.2.2", "7.2.3", "7.3.0", "7.3.1", "7.3.2", "7.3.3", "7.3.4", "7.3.5", "7.3.6", "7.3.7", "7.3.8", "7.4.0", "7.5.0", "7.5.1", "1.0.0", "1.0.1", "1.0.2", "1.0.3", "1.0.4", "1.0.5", "1.0.6", "1.0.7", "1.0.8", "1.0.9", "1.0.10", "1.0.11", "1.0.12", "1.0.13", "1.0.14", "1.1.0", "1.1.1", "1.1.2", "1.1.3", "1.1.4", "2.0.0-alpha", "2.0.0-beta", "2.0.1", "2.0.2", "2.0.3", "2.0.4", "2.0.5", "2.0.6", "2.0.7", "2.0.8", "2.0.9", "2.0.10", "2.0.11", "2.1.0", "2.2.0", "2.2.1", "2.3.0", "2.3.1", "2.3.2", "3.0.0", "3.0.1", "4.0.0", "4.0.2", "4.0.3", "4.1.0", "4.1.1", "4.2.0", "4.2.1", "4.2.2", "4.3.0", "4.3.1", "4.3.2", "4.3.3", "4.3.4", "4.3.5", "4.3.6", "5.0.0", "5.0.1", "5.0.2", "5.0.3", "5.1.0", "5.1.1", "5.2.0", "5.3.0", "5.4.0", "5.4.1", "5.5.0", "5.5.1", "5.6.0", "5.7.0", "5.7.1", "6.0.0", "6.1.0", "6.1.1", "6.1.2", "6.1.3", "6.2.0", "6.3.0"]
Secure versions:
[7.5.2, 7.5.3, 7.5.4, 5.7.2, 6.3.1, 7.6.0, 7.6.1, 7.6.2, 7.6.3]
Recommendation:
Update to version 7.6.3.
108 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 7.6.3 | ISC | 2024-07-16 - 22:27 | 4 months | |
| 7.6.2 | ISC | 2024-05-09 - 16:02 | 6 months | |
| 7.6.1 | ISC | 2024-05-07 - 16:02 | 6 months | |
| 7.6.0 | ISC | 2024-02-05 - 17:06 | 9 months | |
| 7.5.4 | ISC | 2023-07-07 - 21:10 | over 1 year | |
| 7.5.3 | ISC | 2023-06-22 - 21:53 | over 1 year | |
| 7.5.2 | ISC | 2023-06-15 - 20:26 | over 1 year | |
| 7.5.1 | ISC | 1 | 2023-05-12 - 16:39 | over 1 year |
| 7.5.0 | ISC | 1 | 2023-04-17 - 17:22 | over 1 year |
| 7.4.0 | ISC | 1 | 2023-04-10 - 21:57 | over 1 year |
| 7.3.8 | ISC | 1 | 2022-10-04 - 19:40 | about 2 years |
| 7.3.7 | ISC | 1 | 2022-04-12 - 17:26 | over 2 years |
| 7.3.6 | ISC | 1 | 2022-04-06 - 16:35 | over 2 years |
| 7.3.5 | ISC | 1 | 2021-03-23 - 01:37 | over 3 years |
| 7.3.4 | ISC | 1 | 2020-12-01 - 20:15 | almost 4 years |
| 7.3.3 | ISC | 1 | 2020-12-01 - 19:30 | almost 4 years |
| 7.3.2 | ISC | 1 | 2020-04-14 - 17:43 | over 4 years |
| 7.3.1 | ISC | 1 | 2020-04-14 - 16:56 | over 4 years |
| 7.3.0 | ISC | 1 | 2020-04-14 - 01:08 | over 4 years |
| 7.2.3 | ISC | 1 | 2020-04-13 - 18:31 | over 4 years |
| 7.2.2 | ISC | 1 | 2020-04-10 - 16:01 | over 4 years |
| 7.2.1 | ISC | 1 | 2020-04-06 - 23:37 | over 4 years |
| 7.2.0 | ISC | 1 | 2020-04-06 - 23:36 | over 4 years |
| 7.1.3 | ISC | 1 | 2020-02-11 - 21:54 | almost 5 years |
| 7.1.2 | ISC | 1 | 2020-01-31 - 01:29 | almost 5 years |
| 7.1.1 | ISC | 1 | 2019-12-17 - 16:56 | almost 5 years |
| 7.1.0 | ISC | 1 | 2019-12-17 - 01:28 | almost 5 years |
| 7.0.0 | ISC | 1 | 2019-12-14 - 19:36 | almost 5 years |
| 6.3.1 | ISC | 2023-07-10 - 22:38 | over 1 year | |
| 6.3.0 | ISC | 1 | 2019-07-23 - 19:25 | over 5 years |
| 6.2.0 | ISC | 1 | 2019-07-01 - 23:03 | over 5 years |
| 6.1.3 | ISC | 1 | 2019-07-01 - 05:51 | over 5 years |
| 6.1.2 | ISC | 1 | 2019-06-24 - 01:48 | over 5 years |
| 6.1.1 | ISC | 1 | 2019-05-28 - 17:15 | over 5 years |
| 6.1.0 | ISC | 1 | 2019-05-22 - 21:12 | over 5 years |
| 6.0.0 | ISC | 1 | 2019-03-26 - 23:30 | over 5 years |
| 5.7.2 | ISC | 2023-07-10 - 19:57 | over 1 year | |
| 5.7.1 | ISC | 1 | 2019-08-12 - 16:28 | over 5 years |
| 5.7.0 | ISC | 1 | 2019-03-26 - 23:25 | over 5 years |
| 5.6.0 | ISC | 1 | 2018-10-10 - 23:52 | about 6 years |
| 5.5.1 | ISC | 1 | 2018-08-17 - 20:35 | about 6 years |
| 5.5.0 | ISC | 1 | 2018-01-16 - 19:27 | almost 7 years |
| 5.4.1 | ISC | 1 | 2017-07-24 - 18:48 | over 7 years |
| 5.4.0 | ISC | 1 | 2017-07-24 - 16:39 | over 7 years |
| 5.3.0 | ISC | 1 | 2016-07-14 - 16:52 | over 8 years |
| 5.2.0 | ISC | 1 | 2016-06-28 - 18:00 | over 8 years |
| 5.1.1 | ISC | 1 | 2016-06-23 - 18:00 | over 8 years |
| 5.1.0 | ISC | 1 | 2015-11-18 - 23:18 | almost 9 years |
| 5.0.3 | ISC | 1 | 2015-09-11 - 20:27 | about 9 years |
| 5.0.2 | ISC | 1 | 2015-09-11 - 17:09 | about 9 years |
| 5.0.1 | ISC | 1 | 2015-07-13 - 20:02 | over 9 years |
| 5.0.0 | ISC | 1 | 2015-07-11 - 17:29 | over 9 years |
| 4.3.6 | ISC | 1 | 2015-06-01 - 04:16 | over 9 years |
| 4.3.5 | ISC | 1 | 2015-05-29 - 22:25 | over 9 years |
| 4.3.4 | ISC | 1 | 2015-05-05 - 04:26 | over 9 years |
| 4.3.3 | BSD | 1 | 2015-03-27 - 16:56 | over 9 years |
| 4.3.2 | BSD | 1 | 2015-03-27 - 01:26 | over 9 years |
| 4.3.1 | BSD | 3 | 2015-02-24 - 19:49 | over 9 years |
| 4.3.0 | BSD | 3 | 2015-02-12 - 20:08 | over 9 years |
| 4.2.2 | BSD | 3 | 2015-02-10 - 06:46 | almost 10 years |
| 4.2.1 | BSD | 3 | 2015-02-10 - 06:44 | almost 10 years |
| 4.2.0 | BSD | 3 | 2014-12-23 - 09:42 | almost 10 years |
| 4.1.1 | BSD | 3 | 2014-12-19 - 12:57 | almost 10 years |
| 4.1.0 | BSD | 3 | 2014-10-16 - 00:55 | about 10 years |
| 4.0.3 | BSD | 3 | 2014-10-01 - 00:18 | about 10 years |
| 4.0.2 | BSD | 3 | 2014-09-30 - 23:55 | about 10 years |
| 4.0.0 | BSD | 3 | 2014-09-11 - 22:36 | about 10 years |
| 3.0.1 | BSD | 3 | 2014-07-24 - 17:24 | over 10 years |
| 3.0.0 | BSD | 3 | 2014-07-23 - 21:14 | over 10 years |
| 2.3.2 | BSD | 3 | 2014-07-22 - 19:24 | over 10 years |
| 2.3.1 | BSD | 3 | 2014-06-18 - 22:48 | over 10 years |
| 2.3.0 | BSD | 3 | 2014-05-07 - 01:15 | over 10 years |
| 2.2.1 | BSD | 3 | 2013-10-28 - 18:18 | about 11 years |
| 2.2.0 | BSD | 3 | 2013-10-25 - 20:02 | about 11 years |
| 2.1.0 | BSD | 3 | 2013-08-01 - 23:52 | over 11 years |
| 2.0.11 | BSD | 3 | 2013-07-24 - 03:23 | over 11 years |
| 2.0.10 | BSD | 3 | 2013-07-09 - 22:39 | over 11 years |
| 2.0.9 | BSD | 3 | 2013-07-06 - 03:45 | over 11 years |
| 2.0.8 | BSD | 3 | 2013-06-24 - 22:12 | over 11 years |
| 2.0.7 | BSD | 3 | 2013-06-20 - 18:57 | over 11 years |
| 2.0.6 | BSD | 3 | 2013-06-20 - 18:41 | over 11 years |
| 2.0.5 | BSD | 3 | 2013-06-20 - 15:42 | over 11 years |
| 2.0.4 | BSD | 3 | 2013-06-20 - 15:33 | over 11 years |
| 2.0.3 | BSD | 3 | 2013-06-20 - 15:15 | over 11 years |
| 2.0.2 | BSD | 3 | 2013-06-20 - 15:05 | over 11 years |
| 2.0.1 | BSD | 3 | 2013-06-20 - 04:42 | over 11 years |
| 2.0.0-beta | BSD | 3 | 2013-06-18 - 00:01 | over 11 years |
| 2.0.0-alpha | BSD | 3 | 2013-06-15 - 03:29 | over 11 years |
| 1.1.4 | MIT | 3 | 2013-03-01 - 18:14 | over 11 years |
| 1.1.3 | MIT | 3 | 2013-02-06 - 15:42 | almost 12 years |
| 1.1.2 | MIT | 3 | 2013-01-06 - 16:25 | almost 12 years |
| 1.1.1 | MIT | 3 | 2012-11-29 - 00:46 | almost 12 years |
| 1.1.0 | MIT | 3 | 2012-10-02 - 17:02 | about 12 years |
| 1.0.14 | MIT | 3 | 2012-05-27 - 00:47 | over 12 years |
| 1.0.13 | MIT | 3 | 2011-12-21 - 17:07 | almost 13 years |
| 1.0.12 | MIT | 3 | 2011-11-18 - 19:04 | almost 13 years |
| 1.0.11 | MIT | 3 | 2011-11-15 - 16:40 | almost 13 years |
| 1.0.10 | MIT | 3 | 2011-10-04 - 01:51 | about 13 years |
| 1.0.9 | MIT | 3 | 2011-07-20 - 21:38 | over 13 years |
| 1.0.8 | MIT | 3 | 2011-06-27 - 21:58 | over 13 years |