The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a regular expression denial of service (ReDoS).
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node.js | Nodejs | * | 4.3.1 (including) |
| Node-semver | Ubuntu | artful | * |
| Node-semver | Ubuntu | esm-apps/xenial | * |
| Node-semver | Ubuntu | esm-infra-legacy/trusty | * |
| Node-semver | Ubuntu | precise | * |
| Node-semver | Ubuntu | trusty | * |
| Node-semver | Ubuntu | trusty/esm | * |
| Node-semver | Ubuntu | upstream | * |
| Node-semver | Ubuntu | wily | * |
| Node-semver | Ubuntu | xenial | * |
| Node-semver | Ubuntu | yakkety | * |
| Node-semver | Ubuntu | zesty | * |