Regular Expression Denial of Service

Overview

Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

Recommendation

Update to version 4.3.2 or later

References

• Regular Expression Denial of Service - OWASP
• GitHub Advisory