{"action":"Upgrade semver to 5.7.2 or later.","affected":[{"fixed":"7.5.2","introduced":"7.0.0"},{"fixed":"6.3.1","introduced":"6.0.0"},{"fixed":"5.7.2","introduced":"2.0.0-alpha"}],"component":"semver","cve_ids":["CVE-2022-25883"],"ecosystem":"npm","epss":0.02761,"exploited":false,"fixed_versions":["7.5.2","6.3.1","5.7.2"],"ghsa_id":"GHSA-c2qf-rxjj-qqgw","id":"tcs_01M5KFHGB5HNPCH84BSC1WX5Q4","modified_at":"2026-09-10T03:50:02.224637541Z","published_at":"2023-06-21T06:30:28Z","references":["https://osv.dev/vulnerability/GHSA-c2qf-rxjj-qqgw","https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-c2qf-rxjj-qqgw","url":"https://osv.dev/vulnerability/GHSA-c2qf-rxjj-qqgw"}],"summary":"semver vulnerable to Regular Expression Denial of Service"}