Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Sep 28, 2023 | Jun 21, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade npmUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Jun 21, 2023 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Mar 18, 2026 | Mar 17, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Mar 18, 2026 | Mar 17, 2026 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | Sep 27, 2023 | Jun 21, 2023 |
| Debian | — | Upgrade node-semverNo solution exists | May 15, 2025 | Jun 21, 2023 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-packagingUpgrade nodejs | Sep 28, 2023 | Jun 21, 2023 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2023 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-nodemonNo solution existsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | Sep 27, 2023 | Jun 21, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Jun 21, 2023 |
| Splunk | — | — | Sep 30, 2025 | Jun 21, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub