CVE-2021-43307: Semver-Regex Project Semver-Regex

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

Affected products

• Semver-Regex Project Semver-Regex: before 3.1.4 (fixed in 3.1.4); from 4.0.0, before 4.0.3 (fixed in 4.0.3)

Published 2022-06-02. Last modified 2026-06-17.