[GHSA-x6fg-f45m-jf5q] Regular Expression Denial of Service in semver

[ljharb]

Updates

• Affected products

Comments
The affected version range should be narrowed. Versions prior to 1.0.4 are NOT vulnerable to CVE-2015-8855.

The ReDoS vulnerability is caused by \s* whitespace quantifiers in the version parsing regex. These were introduced in commit 5c4c9f6e26c7 ("Close #2 Also, docs."), first published as v1.0.4.

In semver <= 1.0.3 (tag v1.0.3, commit a685e01b), the semver regex is:
[v=]*([0-9]+).([0-9]+).([0-9]+)
This has NO whitespace quantifiers and cannot exhibit catastrophic backtracking.

Starting in v1.0.4, the regex became:
\s*[v=]\s([0-9]+).([0-9]+).([0-9]+)
When composed into expressions.parse as ^\s*\s*[v=]\s...\s*$, the adjacent \s* quantifiers create O(n^2) backtracking on whitespace-padded inputs.

Evidence:

• v1.0.3 source (no \s*): https://github.com/npm/node-semver/blob/v1.0.3/semver.js#L5
• v1.0.4 source (has \s*): https://github.com/npm/node-semver/blob/v1.0.4/semver.js#L5
• Commit introducing \s*: npm/node-semver@5c4c9f6

Replaces #7101.

[Copilot]

Pull request overview

This PR updates the GHSA advisory for CVE-2015-8855 / GHSA-x6fg-f45m-jf5q to reflect that the ReDoS vulnerability in the semver npm package was introduced starting in v1.0.4, narrowing the affected version range.

Changes:

• Update the advisory modified timestamp.
• Narrow the affected range by changing the first introduced event from 0 to 1.0.4.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The affected range was narrowed to start at 1.0.4, but the details text still says "Versions 4.3.1 and earlier ... are affected", which implies all versions <= 4.3.1 (including 1.0.3 and earlier). Please update details to match the new range (e.g., affected versions 1.0.4 through 4.3.1).

[advisory-database]

Hi @ljharb! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!