Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Remediation
References
https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/
Related Vulnerabilities
CVE-2021-28161 Vulnerability in npm package @wiptheia/core
CVE-2022-45389 Vulnerability in maven package com.cloudbees.jenkins.plugins:xpdev
CVE-2022-41915 Vulnerability in maven package io.netty:netty-codec
CVE-2022-27952 Vulnerability in npm package payload
CVE-2020-24660 Vulnerability in npm package node-lemonldap-ng-handler