Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
https://github.com/npm/node-semver/pull/564
https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441