Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Remediation
References
https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/
Related Vulnerabilities
CVE-2020-36181 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2023-24621 Vulnerability in maven package com.esotericsoftware.yamlbeans:yamlbeans
CVE-2020-7642 Vulnerability in maven package org.webjars.npm:lazysizes
CVE-2019-20174 Vulnerability in npm package auth0-lock
CVE-2023-29216 Vulnerability in maven package org.apache.linkis:linkis-engineplugin-jdbc