CVE-2022-25883: Npmjs Semver

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Affected products

• Npmjs Semver: before 5.7.2 (fixed in 5.7.2); from 6.0.0, before 6.3.1 (fixed in 6.3.1); from 7.0.0, before 7.5.3 (fixed in 7.5.3)

Published 2023-06-21. Last modified 2026-06-17.