PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8855 Nodejs CVE debrief

CVE-2015-8855 is a denial-of-service issue in the semver package used in the Node.js ecosystem. A specially long version string can trigger excessive CPU consumption through regular expression backtracking, making the application slow or unresponsive. The issue is rated HIGH and is not listed in CISA KEV in the supplied data.

Vendor
Nodejs
Product
Node.js
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Owners and maintainers of Node.js applications that depend on semver, especially if version strings are accepted from untrusted input. Security teams, SREs, and dependency managers should also review direct and transitive use of the affected package.

Technical summary

NVD describes the flaw as a regular expression denial of service (ReDoS) in semver versions before 4.3.2. The impact is availability-only: no confidentiality or integrity impact is recorded, but crafted long version strings can consume CPU and degrade service. The NVD CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which matches a remotely triggerable availability problem.

Defensive priority

High

Recommended defensive actions

  • Upgrade semver to 4.3.2 or later wherever it is directly or transitively used.
  • Audit Node.js applications and build pipelines for semver dependencies and lockfile pinning.
  • Test any inputs that pass version strings into semver parsing or comparison paths, and reject unexpectedly long or malformed values.
  • Monitor for abnormal CPU spikes or request latency in services that process version strings.
  • If immediate upgrading is not possible, reduce exposure by limiting untrusted access to version-parsing endpoints and constraining input size.

Evidence notes

Primary source text states that semver before 4.3.2 for Node.js allows attackers to cause denial of service via a long version string, described as a ReDoS. NVD assigns CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and lists CWE-399. The supplied references include an Openwall oss-security mailing list post, a SecurityFocus VDB entry, and a NodeSecurity advisory. The NVD CPE mapping in the corpus is broader than the package-level description, so the semver version statement should be treated as the most specific affected-version guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-8855 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-8855

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-8855 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-8855

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.