semver vulnerable to Regular Expression Denial of Service
CVE-2022-25883 (GitHub advisory GHSA-c2qf-rxjj-qqgw) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Inefficient Regular Expression Complexity (CWE-1333), in semver (npm). Affected versions: >= 7.0.0, < 7.5.2; >= 6.0.0, < 6.3.1; >= 2.0.0-alpha, < 5.7.2. It is fixed in 7.5.2, 6.3.1 or 5.7.2, depending on the release line.
Published 21 Jun 2023Updated 4 Feb 2026
- CVE ID
- CVE-2022-25883
- GHSA ID
- GHSA-c2qf-rxjj-qqgw
- EPSS
- 2.76%higher than 85% of CVEs
- Weakness (CWE)
- CWE-1333Inefficient Regular Expression Complexity
- KEV status
- Not in KEV
- Published
- 21 Jun 2023
- Updated
- 4 Feb 2026
- Ecosystem
- npm
- Assigned by (CNA)
- snyk
Summary
Source: OSV (GitHub advisory)
Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Technical details
Source: GitHub Advisory Database
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HHigh7.5Base score from GitHub Advisory Database
- Attack Vector AV
- Network
- Attack Complexity AC
- Low
- Privileges Required PR
- None
- User Interaction UI
- None
- Scope S
- Unchanged
- Confidentiality C
- None
- Integrity I
- None
- Availability A
- High
CISA SSVC decision points
- Exploitation
- poc
- Proof-of-concept code is public
- Automatable
- yes
- Attackers can automate this at scale
- Technical impact
- partial
- Limited control of the affected system
CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.
Affected packages
Source: OSV (GitHub advisory)
- semvernpm
pkg:npm/semver- Affected versions
- >= 7.0.0, < 7.5.2>= 6.0.0, < 6.3.1>= 2.0.0-alpha, < 5.7.2
- Fixed in
- 7.5.26.3.15.7.2
| Package | Affected versions | Fixed in |
|---|---|---|
semver npm pkg:npm/semver |
|
|
Fix
Source: OSV (GitHub advisory)
Fix available
Upgrade to 7.5.2, 6.3.1 or 5.7.2, depending on your release line.
Patch commits
fix: better handling of whitespace (#585)
+156 −27 across 4 files
- semver.js+68 −26
- test/index.js+11 −1
- test/re.js+14 −0
- test/whitespace.js+63 −0
fix: better handling of whitespace (#564)
+136 −72 across 9 files
- classes/comparator.js+2 −1
- classes/range.js+37 −27
- classes/semver.js+1 −1
- functions/coerce.js+1 −1
- internal/re.js+11 −0
- package.json+1 −1
- test/integration/whitespace.js+39 −0
- test/internal/re.js+7 −1
- and 1 more files
fix: better handling of whitespace (#591)
+158 −24 across 4 files
- semver.js+71 −24
- test/index.js+10 −0
- test/re.js+14 −0
- test/whitespace.js+63 −0
Vulnerability intelligence
Root cause analysis
Vulnerable functions
References
Fixes 6
- github.com/npm/node-semver/pull/564
- github.com/npm/node-semver/pull/585
- github.com/npm/node-semver/pull/593
- github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0
- github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
- github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c
Advisories 4
Package 1
Other links 6
- github.com/npm/node-semver/blob/main/classes/range.js
- github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
- github.com/npm/node-semver/blob/main/internal/re.js
- github.com/npm/node-semver/blob/main/internal/re.js%23L138
- github.com/npm/node-semver/blob/main/internal/re.js%23L160
- security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
Credits
Questions about CVE-2022-25883
- What is the GHSA ID for CVE-2022-25883?
- GitHub tracks CVE-2022-25883 as GHSA-c2qf-rxjj-qqgw.
- What is the CVSS score of CVE-2022-25883?
- CVE-2022-25883 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Other published scores: CVSS 3.1 5.3.
- Which versions are affected by CVE-2022-25883?
- semver (npm): >= 7.0.0, < 7.5.2; >= 6.0.0, < 6.3.1; >= 2.0.0-alpha, < 5.7.2.
- How do I fix CVE-2022-25883?
- Upgrade to 7.5.2, 6.3.1 or 5.7.2, depending on the release line. The fix is in commits 2f8fd41, 717534e and 928e56d and pull requests #564, #585 and #593.
- What is the Package URL (PURL) for CVE-2022-25883?
- The affected package's PURL is pkg:npm/semver.
- Is CVE-2022-25883 exploited in the wild?
- CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2022-25883. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 2.76% chance of exploitation in the next 30 days, higher than 85% of CVEs.
Data sources
Upstream records
- OSV (GitHub advisory)LoadedRaw JSON
- GitHub Advisory DatabaseLoadedRaw JSON
- OSV (CVE record)LoadedRaw JSON
- CVE.orgLoaded
- CISA KEV catalogLoaded
Fetched 5 days ago (8 Oct 2026, 14:43 UTC). Records refresh automatically after 24 hours.
Where each part of this page came from
- Title and description
- OSV (GitHub advisory)
- Severity score
- GitHub Advisory Database
- Weakness (CWE)
- GitHub Advisory Database
- Affected packages
- OSV (GitHub advisory)
- Fix
- OSV (GitHub advisory)
- References
- Computed by CVEminer
- SSVC
- CVE.org
- KEV status
- CISA KEV catalog
- EPSS
- GitHub Advisory Database
OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.