# CVE-2022-25883: semver vulnerable to Regular Expression Denial of Service

> CVE-2022-25883 (GitHub advisory GHSA-c2qf-rxjj-qqgw) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Inefficient Regular Expression Complexity (CWE-1333), in semver (npm). Affected versions: >= 7.0.0, < 7.5.2; >= 6.0.0, < 6.3.1; >= 2.0.0-alpha, < 5.7.2. It is fixed in 7.5.2, 6.3.1 or 5.7.2, depending on the release line.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2022-25883

| Field | Value |
| --- | --- |
| CVE | CVE-2022-25883 |
| GHSA | GHSA-c2qf-rxjj-qqgw |
| Severity | High |
| CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (GitHub Advisory Database) |
| CVSS 3.1 | 5.3 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P` (CVE.org) |
| CWE | CWE-1333 Inefficient Regular Expression Complexity |
| EPSS | 2.76% (higher than 85% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable yes, technical impact partial |
| Published | 21 Jun 2023 |
| Modified | 4 Feb 2026 |

## Description

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| semver | npm | `pkg:npm/semver` | >= 7.0.0, < 7.5.2; >= 6.0.0, < 6.3.1; >= 2.0.0-alpha, < 5.7.2 | 7.5.2, 6.3.1, 5.7.2 |

## Fix commits

- Patch: https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0
- Patch: https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
- Patch: https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c
- Pull request: https://github.com/npm/node-semver/pull/564
- Pull request: https://github.com/npm/node-semver/pull/585
- Pull request: https://github.com/npm/node-semver/pull/593
- Release: https://github.com/npm/node-semver/commit/f8cc313550691a50d9662d8c94f0c033717efd7d (5.7.2)
- Release: https://github.com/npm/node-semver/commit/44d27bc007e4827e9b797d6145f1076c127005f2 (6.3.1)
- Release: https://github.com/npm/node-semver/commit/7fdf1ef223826b428d7f8aaf906e9eeefa9469f9 (7.5.3)

## Questions

**What is the GHSA ID for CVE-2022-25883?**

GitHub tracks CVE-2022-25883 as GHSA-c2qf-rxjj-qqgw.

**What is the CVSS score of CVE-2022-25883?**

CVE-2022-25883 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Other published scores: CVSS 3.1 5.3.

**Which versions are affected by CVE-2022-25883?**

semver (npm): >= 7.0.0, < 7.5.2; >= 6.0.0, < 6.3.1; >= 2.0.0-alpha, < 5.7.2.

**How do I fix CVE-2022-25883?**

Upgrade to 7.5.2, 6.3.1 or 5.7.2, depending on the release line. The fix is in commits 2f8fd41, 717534e and 928e56d and pull requests #564, #585 and #593.

**What is the Package URL (PURL) for CVE-2022-25883?**

The affected package's PURL is pkg:npm/semver.

**Is CVE-2022-25883 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2022-25883. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 2.76% chance of exploitation in the next 30 days, higher than 85% of CVEs.

## References

- https://github.com/npm/node-semver/pull/564 (fix)
- https://github.com/npm/node-semver/pull/585 (fix)
- https://github.com/npm/node-semver/pull/593 (fix)
- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0 (fix)
- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441 (fix)
- https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2022-25883 (advisory)
- https://security.netapp.com/advisory/ntap-20241025-0004 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25883.json (advisory)
- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw (advisory)
- https://github.com/npm/node-semver (package)
- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
- https://github.com/npm/node-semver/blob/main/internal/re.js#L138
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2022-25883), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.