USY-2026-0108 · Regular expression denial of service · score 5.5

Backtracking in range parsing

Range strings with long whitespace runs cause exponential backtracking in the comparator grammar. Reached anywhere a user-supplied version range is parsed.

SyntheticThis advisory is invented for the demonstration. semver is a real package; nothing described here has been reported against it.

Affected package

semver

Affected releases

4 from 7.0.0

Fixed in

7.5.2

Published

11 Feb 2026

Blast radius

8 of 12 · nearest 2

Admin ConsoleInternal Tools2 hops · 2 affected releases

Application
Admin Console
Hop 1declared · ^7.0.4
next7.0.4
Faulttransitive · ^7.0.5
semver7.0.5
Affected. Fixed in 7.5.2.

Checkout ServicePayments2 hops · 2 affected releases

Not reached · 4Data Exporter, Docs Site, Fraud Scoring, Reporting Pipeline

Where to cut

12 junctions

Every exposed application reaches this on a route of its own: no intermediate package is shared by more than one path. There is no single change here; each application has to move separately, or the ecosystem has to move first.

@prisma/client 4.6.0on 1 of 8 paths

Ledger API

eslint 1.4.11on 1 of 8 paths

Auth Gateway

kafkajs 6.0.5on 1 of 8 paths

Mobile BFF

luxon 1.3.0on 1 of 8 paths

Notification Relay

moment 3.1.0on 1 of 8 paths

Storefront Web

next 7.0.4on 1 of 8 paths

Admin Console

Affected releases

7.0.515 Jan 2026

7.0.222 May 2025

7.0.115 Sep 2024

7.0.025 Mar 2024

Package role

Version range resolution21M downloads/wk

Who can publish it

1 account

Hiroshi Sokolovhiroshi-sokolov2FA on

One account can publish this package. Whoever holds it can reach everything downstream of it, with or without an advisory.