Regular expression denial of service in semver
Priority HIGH 72CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 fixed, 37 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02761 86th percentileScored 2026-11-07
Fix Partial semver: 7.5.2semver (npm): 7.5.2, 6.3.1, 5.7.2Red Hat: 15 advisoriesRed Hat: 15 fixed, 37 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | semver | before 7.5.2 | 7.5.2 | Patch available | CNA |
| — | semver (npm) | 7.0.0 to before 7.5.2 | 7.5.2 | Patch available | GHSA-c2qf-rxjj-qqgw |
| — | semver (npm) | 6.0.0 to before 6.3.1 | 6.3.1 | Patch available | GHSA-c2qf-rxjj-qqgw |
| — | semver (npm) | 2.0.0-alpha to before 5.7.2 | 5.7.2 | Patch available | GHSA-c2qf-rxjj-qqgw |
- semver Vendor— Affected before 7.5.2 Fixed in 7.5.2 Patch available CNA
- semver (npm) Vendor— Affected 7.0.0 to before 7.5.2 Fixed in 7.5.2 Patch available GHSA-c2qf-rxjj-qqgw
- semver (npm) Vendor— Affected 6.0.0 to before 6.3.1 Fixed in 6.3.1 Patch available GHSA-c2qf-rxjj-qqgw
- semver (npm) Vendor— Affected 2.0.0-alpha to before 5.7.2 Fixed in 5.7.2 Patch available GHSA-c2qf-rxjj-qqgw
Remediation
- Fix · CNA semver Fixed in 7.5.2
- Fix · GHSA-c2qf-rxjj-qqgw semver (npm) Fixed in 7.5.2 Advisory →
- Fix · GHSA-c2qf-rxjj-qqgw semver (npm) Fixed in 6.3.1 Advisory →
- Fix · GHSA-c2qf-rxjj-qqgw semver (npm) Fixed in 5.7.2 Advisory →
Red Hat 15 advisories
- RHSA-2025:19094 Released 2025-10-23 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.24.0 Release.
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +4
- RHSA-2024:6044 Released 2024-08-29 · Red Hat rating LowRed Hat Advanced Cluster Management 2.11.2 bug fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +40
- RHSA-2024:5955 Released 2024-08-28 · Red Hat rating LowMulticluster Engine for Kubernetes 2.6.2 security updates and bug fixes
- multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
- multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +31
Show 12 more Red Hat advisories
- RHSA-2024:0719 Released 2024-02-07 · Red Hat rating ModerateMigration Toolkit for Runtimes security, bug fix and enhancement update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8, mtr/mtr-web-executor-container-rhel8
- RHSA-2023:7222 Released 2023-11-15 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.8.2 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-ui-rhel8
- RHSA-2023:5485 Released 2023-10-06 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el8eap +47
- RHSA-2023:5486 Released 2023-10-06 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el9eap +47
- RHSA-2023:5484 Released 2023-10-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el7eap +47
- RHSA-2023:5488 Released 2023-10-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update
- Red Hat JBoss Enterprise Application Platform io.netty.netty-handler-4.1.94.Final-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.76.0.redhat-00001.jar, org.jboss.hal.hal-console-3.3.19.Final-redhat-00001-resources.jar +2
- RHSA-2023:5379 Released 2023-09-28 · Red Hat rating ImportantNetwork Observability 1.4.0 for OpenShift
- NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +2
- RHSA-2023:5362 Released 2023-09-26 · Red Hat rating Importantnodejs:18 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.17.1-1.module+el8.8.0+19757+8ca87034.aarch64::nodejs:18, nodejs-1:18.17.1-1.module+el8.8.0+19757+8ca87034.ppc64le::nodejs:18, nodejs-1:18.17.1-1.module+el8.8.0+19757+8ca87034.s390x::nodejs:18 +20
- RHSA-2023:5360 Released 2023-09-26 · Red Hat rating Importantnodejs:16 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.aarch64::nodejs:16, nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.ppc64le::nodejs:16, nodejs-1:16.20.2-2.module+el8.8.0+19898+ab99ba34.s390x::nodejs:16 +19
- RHSA-2023:5363 Released 2023-09-26 · Red Hat rating Importantnodejs:18 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.17.1-1.module+el9.2.0.z+19753+58118bc0.aarch64::nodejs:18, nodejs-1:18.17.1-1.module+el9.2.0.z+19753+58118bc0.ppc64le::nodejs:18, nodejs-1:18.17.1-1.module+el9.2.0.z+19753+58118bc0.s390x::nodejs:18 +20
- RHSA-2023:5361 Released 2023-09-26 · Red Hat rating Importantnodejs:16 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.aarch64::nodejs:16, nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.ppc64le::nodejs:16, nodejs-1:16.20.2-2.module+el8.6.0+19897+9590a839.s390x::nodejs:16 +19
- RHSA-2023:4341 Released 2023-08-02 · Red Hat rating ModerateLogging Subsystem 5.7.4 - Red Hat OpenShift bug fix and security update
- RHOL 5.7 for RHEL 8 openshift-logging/fluentd-rhel8, openshift-logging/logging-view-plugin-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Certification for Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Certification for Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Discovery 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Data Foundation 4 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2023:7222 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2024:0719 |
| NETOBSERV 1.4 for RHEL 9 | Fixed | RHSA-2023:5379 |
| RHOL 5.7 for RHEL 8 | Fixed | RHSA-2023:4341 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | Fixed | RHSA-2024:6044 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:5360, RHSA-2023:5362 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:5363 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:5361 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:5484 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:5485 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:5486 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:5488 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 | Fixed | RHSA-2025:19094 |
| multicluster engine for Kubernetes 2.6 for RHEL 8 | Fixed | RHSA-2024:5955 |
| multicluster engine for Kubernetes 2.6 for RHEL 9 | Fixed | RHSA-2024:5955 |
Not affected: 13 products
- 8Base-RHMTC-1.8
- Cryostat 2
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Runtimes 1 on RHEL 8
- RHOL 5.7 for RHEL 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.24
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25883
- 2026-10-03 Alias added: GHSA-c2qf-rxjj-qqgw
References
Patch 2
Advisory 2
Other 12
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
- https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
- https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
- https://github.com/npm/node-semver/pull/585
- https://github.com/npm/node-semver/pull/593
- https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0
- https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c
- https://github.com/npm/node-semver
- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104
- https://github.com/npm/node-semver/blob/main/internal/re.js#L138
- https://github.com/npm/node-semver/blob/main/internal/re.js#L160
- https://security.netapp.com/advisory/ntap-20241025-0004
Sources
- CVE-2022-25883 · CVE Program
- CVE-2022-25883 · NVD
- FIRST EPSS
- GHSA-c2qf-rxjj-qqgw · GitHub Advisory Database · CC BY 4.0
- CVE-2022-25883 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences