Executive brief
The semver-regex library is a widely-used npm package that validates semantic version strings (e.g., "1.2.3"). The regular expression in this package can be exploited by attackers who submit crafted, malformed version strings that cause the regex engine to hang and consume excessive CPU resources. This denial of service attack can freeze or crash applications that accept untrusted version strings, impacting service availability for legitimate users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) issue arising from inefficient regex complexity (CWE-1333). The semver-regex package's regular expression pattern exhibits catastrophic backtracking when processing specially crafted input strings with nested quantifiers and overlapping patterns. An attacker with the ability to provide untrusted input to the regex (via a public API, form field, or uploaded data) can cause exponential time complexity in the regex matching engine. The vulnerability affects all versions before 3.1.3 and version 4.0.0 (fixed in 4.0.1). Mitigation requires users to implement input length limits (truncate to ~50 characters) and regex execution timeouts when processing untrusted user input, as the maintainer recommends against further optimization due to functional constraints.
Affected products
- Sindre Sorhus semver-regex before 3.1.3, 4.0.0 (fixed 4.0.1)
Timeline
- 2021-09-15: disclosed: Published on NVD
- 2021-09-20: advisory: GHSA advisory published
- 2021-09: patched: Fixed in semver-regex 3.1.3 and 4.0.1