Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-nodemon | Sep 28, 2023 | Jun 21, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade v8-devel | Feb 17, 2025 | Jun 21, 2023 |
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Mar 18, 2026 | Mar 17, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Mar 18, 2026 | Mar 17, 2026 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemon | Sep 27, 2023 | Jun 21, 2023 |
| Debian | — | Upgrade node-semverNo solution exists | May 15, 2025 | Jun 21, 2023 |
| Oracle_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemon | Sep 28, 2023 | Jun 21, 2023 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jun 21, 2023 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejsNo solution existsUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Sep 27, 2023 | Jun 21, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Jun 21, 2023 |
| Splunk | — | — | Sep 30, 2025 | Jun 21, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub