7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-25883

CVE-2022-25883: semver vulnerable to Regular Expression Denial of Service

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2022-25883

CVE-2022-25883:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
semver	npm	>= 7.0.0, < 7.5.2	7.5.2
semver	npm	>= 6.0.0, < 6.3.1	6.3.1
semver	npm	< 5.7.2	5.7.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the semver package, triggered when parsing range strings with excessive whitespace. The analysis of the provided commit patches (e.g., 717534ee353682f3bcf33e60a8af4292626d4441 for modern versions, and backports like d4530b8c9785923be4ebaa01324c48549acb0856 for older monolithic semver.js) shows that the vulnerability affected functions responsible for parsing version and range strings. The primary vulnerable function, as stated in the advisory, is new Range (the Range constructor). Other functions like Range.prototype.parseRange, Comparator constructor, Comparator.prototype.parse, SemVer constructor, and coerce were also vulnerable because they used the same inefficient regular expressions or lacked sufficient input sanitization for whitespace before regex processing. The patches mitigate this by introducing aggressive whitespace normalization at the beginning of constructors and by replacing vulnerable regexes (referred to as re) with safer versions (safeRe) that use bounded quantifiers for whitespace, thus preventing catastrophic backtracking.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.