Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Remediation
References
https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/
Related Vulnerabilities
CVE-2017-12629 Vulnerability in maven package org.apache.lucene:lucene-queryparser
CVE-2018-3713 Vulnerability in npm package angular-http-server
CVE-2019-12043 Vulnerability in maven package org.webjars.bower:remarkable
CVE-2020-26237 Vulnerability in maven package org.webjars.bowergithub.highlightjs:highlight.js
CVE-2023-49372 Vulnerability in maven package com.jfinal:jfinal