-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the regex pattern returned by semverRegex() in index.js. The commit diff shows critical additions of lazy quantifiers (? modifiers) to {0,100} ranges and other groups, which directly addresses catastrophic backtracking. The added test case in test.js specifically measures execution time when testing ReDoS-prone patterns like '0.0.1-...', confirming the regex's test() method was vulnerable. Since semverRegex() is the sole function generating the regex pattern, and the patch exclusively modifies this function's output, it is conclusively identified as the vulnerable component.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| semver-regex | npm | < 3.1.4 | 3.1.4 |
| semver-regex | npm | >= 4.0.0, < 4.0.3 | 4.0.3 |
Ongoing coverage of React2Shell