semver (npm)
The semver parser for node (the one npm uses)
Advisories
8
Latest version
7.8.5
Released Jun 19, 2026
License
ISC
OpenSSF Scorecard
6.4 / 10
How to fix
Upgrading to 7.5.2 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install semver@7.8.5yarn
yarn add semver@7.8.5pnpm
pnpm add semver@7.8.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service |
High EPSS 2.76% |
>= 2.0.0-alpha, < 5.7.2 | 5.7.2 |
| GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service |
High EPSS 2.76% |
>= 7.0.0, < 7.5.2 | 7.5.2 |
| GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service |
High EPSS 2.76% |
>= 6.0.0, < 6.3.1 | 6.3.1 |
| GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service |
High EPSS 2.76% |
>= 7.0.0, < 7.5.2 | 7.5.2 |
| GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service |
High EPSS 2.76% |
>= 6.0.0, < 6.3.1 | 6.3.1 |
| GHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of Service |
High EPSS 2.76% |
>= 2.0.0-alpha, < 5.7.2 | 5.7.2 |
| GHSA-x6fg-f45m-jf5q Regular Expression Denial of Service in semver |
High EPSS 6.89% |
>= 1.0.4, < 4.3.2 | 4.3.2 |
| GHSA-x6fg-f45m-jf5q Regular Expression Denial of Service in semver |
High EPSS 6.89% |
>= 1.0.4, < 4.3.2 | 4.3.2 |
Source: git+https://github.com/npm/node-semver.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor