Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-devel | Sep 28, 2023 | Jun 21, 2023 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-npmamazon-linux-2023-upgrade-v8-devel | Feb 17, 2025 | Jun 21, 2023 | |
| Atlassian Bitbucket | atlassian-bitbucket-upgrade-latest | Mar 18, 2026 | Mar 17, 2026 | |
| Atlassian Jira | atlassian-jira-upgrade-latest | Mar 18, 2026 | Mar 17, 2026 | |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-debuginfoUpgrade npm | Sep 27, 2023 | Jun 21, 2023 |
| Debian | — | No solution existsUpgrade node-semver | May 15, 2025 | Jun 21, 2023 |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npm | Sep 28, 2023 | Jun 21, 2023 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2023 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-docsNo solution existsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-devel | Sep 27, 2023 | Jun 21, 2023 |
| Splunk | — | Update Splunk to the latest version | Sep 30, 2025 | Jun 21, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub