GHSA-x6fg-f45m-jf5q

Regular Expression Denial of Service in semver

Source: GitHub Advisory Database (reviewed) High CVE-2015-8855

Packages

Ecosystem	Package	Affected	Fixed in
npm	semver	>= 1.0.4, < 4.3.2	4.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Versions 4.3.1 and earlier of `semver` are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed. ## Recommendation Update to version 4.3.2 or later

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-8855 advisory
https://github.com/github/advisory-database/pull/7102 web
https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0 web
https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70 web
https://github.com/advisories/GHSA-x6fg-f45m-jf5q advisory
https://github.com/npm/node-semver package
https://www.npmjs.com/advisories/31 web
https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS web
http://www.openwall.com/lists/oss-security/2016/04/20/11 web
http://www.securityfocus.com/bid/86957 web