Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
Remediation
References
https://research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/
Related Vulnerabilities
CVE-2020-15366 Vulnerability in maven package org.webjars.bower:ajv
CVE-2022-29647 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2023-35166 Vulnerability in maven package org.xwiki.platform:xwiki-platform-help-ui
CVE-2021-32860 Vulnerability in maven package org.webjars.npm:izimodal
CVE-2020-13957 Vulnerability in maven package org.apache.solr:solr-core