LowGHSA-4x5v-gmq8-25chCVE-2021-43307
Regular expression denial of service in semver-regex
Published 3 Jun 2022 · Updated 10 Sept 2026
Affected packages
semver-regexnpm
- Affected
- <3.1.4
- Fixed in
- 3.1.4
Update to the fixed version for your release line, for example:
npm install semver-regex@3.1.4semver-regexnpm
- Affected
- >=4.0.0 <4.0.3
- Fixed in
- 4.0.3
Update to the fixed version for your release line, for example:
npm install semver-regex@4.0.3Details
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Is GHSA-4x5v-gmq8-25ch in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected semver-regex, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.