CVE-2022-25883

Published: Jun 21, 2023Modified: Sep 23, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Affected (3)

Products: Npmjs: Semver

Npmjs

1 product

Semver

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Npmjs Semver	Before 5.7.2
Npmjs Semver	From 6.0.0 to 6.3.1
Npmjs Semver	From 7.0.0 to 7.5.3

Related CWEs

CWE-1333

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (13)

https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104

Source: report@snyk.io

Broken Link

https://github.com/npm/node-semver/blob/main/internal/re.js%23L138

Source: report@snyk.io

Broken Link

https://github.com/npm/node-semver/blob/main/internal/re.js%23L160

Source: report@snyk.io

Broken Link

https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/npm/node-semver/pull/564

Source: report@snyk.io

PatchThird Party Advisory

https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795

Source: report@snyk.io

ExploitPatchThird Party Advisory

https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104