CVE-2015-8855

7.8

HIGHCVSS v2

Published

January 23, 2017

Affected

3 projects

Assigned by

MITRE

Severity scale

010

Description

The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

nodejs

Python Package IndexPython bindings and utils for Node.js and io.js

<= 4.3.1NVD

nodejs

NPM

<= 4.3.1NVD

Node.js

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

<= 4.3.1NVD

Security Advisories

CVE-2015-8855

Description

More on this CVE