PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8315 Vercel CVE debrief

CVE-2015-8315 describes a regular expression denial of service (ReDoS) in the Node.js ms package before version 0.7.1. An attacker who can supply a long version string may trigger excessive CPU consumption, resulting in denial of service. NVD rates the issue High with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Vendor
Vercel
Product
CVE-2015-8315
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Teams that depend on the Node.js ms package, especially applications that accept untrusted input which may reach version parsing or related matching logic. Security and platform teams should care if dependency versions are not pinned or regularly audited.

Technical summary

The vulnerability is cataloged as CWE-1333 and is exposed through ReDoS behavior in regex processing. NVD’s vulnerable CPE criteria end before 0.7.1, indicating that versions prior to 0.7.1 are affected. The published CVSS 3.1 vector shows a network-reachable, low-complexity attack with no privileges or user interaction required, impacting availability only.

Defensive priority

High

Recommended defensive actions

  • Upgrade ms to version 0.7.1 or later wherever it is directly or transitively used.
  • Audit lockfiles and dependency trees to confirm no deployed artifact still resolves to ms versions before 0.7.1.
  • Review any code paths that accept attacker-controlled strings and ensure they cannot reach regex-heavy parsing without validation or length limits.
  • Add dependency monitoring and vulnerability scanning so future ReDoS issues in transitive packages are detected quickly.
  • If immediate upgrade is not possible, reduce exposure by minimizing untrusted inputs and placing strict length validation in front of affected parsing paths.

Evidence notes

The source corpus identifies the issue as a CPU-consumption denial of service caused by a long version string, and maps it to CWE-1333. NVD lists the affected range as versions before 0.7.1 and assigns CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The reference set includes an OSS-security mailing list post and third-party advisories; some reference URLs are marked Broken Link in the source metadata.

Official resources

Use the CVE publication date, 2017-01-23T21:59:00.423Z, as the disclosure anchor. The source references include an earlier OSS-security mailing list advisory, but the CVE record itself was published by NVD on the date above.