Skip to content
OpenAdvisories

Package · Debian

node-semver

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.3
    CVE-2022-25883

    semver vulnerable to Regular Expression Denial of Service

    Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

    semver node-semver node-semver Debian Ubuntu npm
  • High 7.5
    CVE-2015-8855

    Regular Expression Denial of Service in semver

    The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

    semver node-semver node-semver Debian Ubuntu npm