CVE-2021-43307: semver-regex_project semver-regex
CVSS: 7.5v3.1HighModified
AliasesGHSA-4x5v-gmq8-25chCGA-3f5v-3vr5-6jqqCGA-5j8v-vh48-2fcrCGA-69fr-cq83-j67rCGA-7493-5qc7-72q4CGA-7jjv-7r8j-g9cpCGA-8x78-rf9j-m2m3CGA-hcrw-8p82-g2jfCGA-p926-87g2-3x62CGA-pqhj-fcjh-9hc4CGA-q99v-hcc7-f6hpCGA-vjpw-vj82-qh25CGA-xj6h-8gpr-h35c
Published 01-06-2022Last modified 17-09-2024
Vulnerability summary
CVE-2021-43307 is a high (CVSS 7.5) vulnerability in semver-regex_project semver-regex. EPSS estimates a 1.53% chance of exploitation in the next 30 days, higher than 74.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.53%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 01-06-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources4 sources · 5.9–7.5
- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.53%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
-0.04 pp
From 1.58% on 19-09-2026
19-09-202619-10-2026
EPSS score1.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (research.jfrog.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- pgadmin4< 9.1-r1
- pgadmin4-oci-entrypoint< 9.1-r1
- py3.10-captum< 0.9.0-r1
- py3.11-captum< 0.9.0-r1
- py3.12-captum< 0.9.0-r1
Npm1 product
- semver-regex< 3.1.4 | ≥ 4.0.0, < 4.0.3
Semver-regex1 product
- semver-regex≥ unspecified, < 3.1.4
Semver-regex_project1 product
- semver-regex< 3.1.4 | ≥ 4.0.0, < 4.0.3
Wordpress1 product
- insert-special-characters≤ 1.0.4 (fixed in 1.0.5)
5 vendors · 10 products
References
6 links- research.jfrog.com/vulnerabilities/semver-regex-redos-xray-211349/X Refsource MISCEVIDENCEExploitThird Party Advisory
