Spotted what might be an issue in package-lock.json around line 855.
This high-severity finding identifies a Regular Expression Denial of Service (ReDoS) vulnerability in semver v5.6.0 (CVE-2022-25883). When the new Range() method parses untrusted or maliciously formatted version strings, inefficient regex patterns cause catastrophic backtracking. This leads to excessive CPU consumption, thread blocking, and potential application hangs, posing a significant risk of service disruption. Immediate upgrade is required.
Something like this might fix it:
Update the semver dependency to a patched version in your package.json and regenerate the lock file.
```diff
--- a/package.json
+++ b/package.json
@@ -..., +... @@
- "semver": "^5.6.0",
+ "semver": "^5.7.2",
```
Run: npm install semver@^5.7.2
Verify the fix via npm audit and restart your application to load the patched module.
For reference: rule CVE-2022-25883. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
package-lock.jsonaround line 855.This high-severity finding identifies a Regular Expression Denial of Service (ReDoS) vulnerability in semver v5.6.0 (CVE-2022-25883). When the new Range() method parses untrusted or maliciously formatted version strings, inefficient regex patterns cause catastrophic backtracking. This leads to excessive CPU consumption, thread blocking, and potential application hangs, posing a significant risk of service disruption. Immediate upgrade is required.
Something like this might fix it:
For reference: rule
CVE-2022-25883. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.