[Fixed] How to approach and fix npm security issue(s) semver vulnerable to Regular Expression Denial of Service – Npm

The Problem:

npm security issue(s) semver vulnerable to Regular Expression Denial of Service.

npm outdated lists multiple outdated packages, but adding semver to resolutions in package.json results in an error when running npm install.

The error is due to a missing file in the semver package.

How can this issue be resolved efficiently while prioritizing feature development?

The Solutions:

Solution 1: Update to semver version ^7.5.3

The vulnerability in semver has been fixed in version ^7.5.3. To update to this version, add the following to your `package.json`:

"overrides": {
  "semver": "^7.5.3"
}

After making this change, run npm i to install the updated version of semver.

Solution 2: Update npm version

If you are using npm versions less than 7.5.2, you are vulnerable to Regular Expression Denial of Service attack. Update your npm version to 7.5.2 or later by running the following command:

“`
npm i -g npm@latest
“`

Solution 3: Fix without modifying package.json

This solution involves identifying the package that depends on the vulnerable semver version and addressing it directly.

1. Identify the Dependent Package:

   1. Check the package-lock.json file to find the package that depends on semver.
   2. In this case, semver was a dependency of the nodemon package.

2. Uninstall and Reinstall the Dependent Package:

   1. Uninstall the dependent package (e.g., npm uninstall nodemon).
   2. Reinstall the dependent package as a development dependency (e.g., npm install --save-dev nodemon).

3. Dependency Update:

   1. This action will update the dependency to its latest version, which should address the security issue.

4. Commit Changes:

   1. Commit the changes to your version control system to track the security fix.

This approach ensures that the security vulnerability is resolved without modifying the package.json file directly. It is recommended to review the dependency tree and update other vulnerable packages as needed to enhance overall security.