CVE-2022-25883

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

5.3

EPSS

2.76%

Published

Jun 21, 2023

Modified

Sep 23, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-1333CWE-1333CWE-1333

Affected Products (3)

npmjs · semver (up to 5.7.2)vulnerable

npmjs · semver (up to 6.3.1)vulnerable

npmjs · semver (up to 7.5.3)vulnerable

References (13)

https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104

Broken Link

https://github.com/npm/node-semver/blob/main/internal/re.js%23L138

Broken Link

https://github.com/npm/node-semver/blob/main/internal/re.js%23L160

Broken Link

https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441

PatchThird Party Advisory

https://github.com/npm/node-semver/pull/564

PatchThird Party Advisory

https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795

ExploitPatchThird Party Advisory

https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104

Broken Link

https://github.com/npm/node-semver/blob/main/internal/re.js%23L138

Broken Link

https://github.com/npm/node-semver/blob/main/internal/re.js%23L160

Broken Link

https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441

PatchThird Party Advisory

https://github.com/npm/node-semver/pull/564

PatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20241025-0004/

Third Party Advisory

https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795

ExploitPatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs