Regular Expression Denial of Service in semver (GHSA-x6fg-f45m-jf5q)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-8855
Severity: HIGH · CWE: CWE-1333

Versions 4.3.1 and earlier of `semver` are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.



## Recommendation

Update to version 4.3.2 or later

Affected packages:
package: ecosystem: npm
name: semver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.2