Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Sep 28, 2023 | Jun 21, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade npmUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-docs | Feb 17, 2025 | Jun 21, 2023 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Mar 18, 2026 | Mar 17, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Mar 18, 2026 | Mar 17, 2026 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-debuginfoUpgrade npm | Sep 27, 2023 | Jun 21, 2023 |
| Debian | — | No solution existsUpgrade node-semver | May 15, 2025 | Jun 21, 2023 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-full-i18n | Sep 28, 2023 | Jun 21, 2023 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2023 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejsNo solution existsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfo | Sep 27, 2023 | Jun 21, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Jun 21, 2023 |
| Splunk | — | — | Sep 30, 2025 | Jun 21, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub