Executive brief
The semver library is a widely-used npm package that parses and compares software version numbers. A Regular Expression Denial of Service (ReDoS) vulnerability in the Range parsing function allows attackers to cause the application to hang or become unresponsive by providing specially crafted version range inputs. This can lead to service unavailability for any application that uses semver to process untrusted version data.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) issue in the semver library's Range constructor, specifically in the regular expressions used to parse version range strings. The vulnerable regexes in re.js (lines 138 and 160) can experience catastrophic backtracking when processing untrusted user input containing certain patterns. An attacker can provide malicious version range strings to the Range function, causing excessive CPU consumption and service denial. The vulnerability affects semver versions before 5.7.2 on the 5.x branch, before 6.3.1 on the 6.x branch, and before 7.5.2 on the 7.x branch. Patches were released in June 2023 to fix the underlying regex patterns.
Affected products
- npm semver before 5.7.2, 6.0.0-6.3.0, 7.0.0-7.5.1
Timeline
- 2023-06-21: disclosed
- 2023-06-21: patched: Fixes released in versions 5.7.2, 6.3.1, and 7.5.2