PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8315 Vercel CVE debrief

CVE-2015-8315 describes a regular expression denial of service (ReDoS) in the Node.js ms package before version 0.7.1. An attacker who can supply a long version string may trigger excessive CPU consumption, resulting in denial of service. NVD rates the issue High with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Vendor
Vercel
Product
Ms
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Teams that depend on the Node.js ms package, especially applications that accept untrusted input which may reach version parsing or related matching logic. Security and platform teams should care if dependency versions are not pinned or regularly audited.

Technical summary

The vulnerability is cataloged as CWE-1333 and is exposed through ReDoS behavior in regex processing. NVD’s vulnerable CPE criteria end before 0.7.1, indicating that versions prior to 0.7.1 are affected. The published CVSS 3.1 vector shows a network-reachable, low-complexity attack with no privileges or user interaction required, impacting availability only.

Defensive priority

High

Recommended defensive actions

  • Upgrade ms to version 0.7.1 or later wherever it is directly or transitively used.
  • Audit lockfiles and dependency trees to confirm no deployed artifact still resolves to ms versions before 0.7.1.
  • Review any code paths that accept attacker-controlled strings and ensure they cannot reach regex-heavy parsing without validation or length limits.
  • Add dependency monitoring and vulnerability scanning so future ReDoS issues in transitive packages are detected quickly.
  • If immediate upgrade is not possible, reduce exposure by minimizing untrusted inputs and placing strict length validation in front of affected parsing paths.

Evidence notes

The source corpus identifies the issue as a CPU-consumption denial of service caused by a long version string, and maps it to CWE-1333. NVD lists the affected range as versions before 0.7.1 and assigns CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The reference set includes an OSS-security mailing list post and third-party advisories; some reference URLs are marked Broken Link in the source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-8315 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-8315

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-8315 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-8315

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.