Executive brief
The semver-regex library is an npm package used to validate semantic versioning strings. An attacker who can supply malicious input to the package's test() method can trigger excessive CPU consumption through a denial-of-service attack, potentially disrupting services that rely on this library for version validation. Applications accepting untrusted version strings from users or network sources are at risk if the regex matching is not protected by execution timeouts.
Technical details
This is an exponential ReDoS (Regular Expression Denial of Service) vulnerability in the semver-regex npm package, triggered when the test() method processes untrusted input. The vulnerability stems from catastrophic backtracking in the regular expression used to match semantic version strings; an attacker can craft a malicious input string (e.g., '0.0.1-' + '-.--'.repeat(i) + ' ') that causes the regex engine to exhibit exponential time complexity. The attack requires only the ability to pass arbitrary strings to the test() method with no authentication or special preconditions. An attacker can cause denial of service by exhausting CPU resources on affected systems. The vulnerability was patched in version 3.1.4 (for versions <3.1.4) and 4.0.3 (for version 4.0.0–4.0.2).
Affected products
- npm semver-regex <3.1.4; 4.0.0-4.0.2
Timeline
- 2022-05-30: disclosed
- 2022-06-03: advisory
- 2022-06-03: patched: Version 3.1.4 and 4.0.3 released