There is a logical flaw in VERSION-RANGE-SPEC, as there is only an OR-operator for ranges. At least for npms semvers there should be an AND operator.

One of the examples:
vers:npm/1.2.3|>=2.0.0|<5.0.0

This would essentially parse to every version, as everything mathes less than 5.0.0 or greater or equal to 2.0.0

Following the npm semver spec (https://github.com/npm/node-semver#ranges) this would have been written as:

1.2.3 || >=2.0.0 <5.0.0

Parsing to either 1.2.3 or (greater or equal to 2.0.0 AND less than 5.0.0)

That AND operator seem to have gotten lost on the way...