CVE-2015-8855

Severity: High
CVSS: 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA KEV: Not in the cached KEV catalog
EPSS: No cached EPSS score

Affected and fixed versions

OSV did not list a semver range for this package on the entry we stored.

Plain-language text is shown only when it is already cached. This page does not generate it.

The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

Aliases: GHSA-x6fg-f45m-jf5q

Advisory on OSV.dev · published 2017-01-23 · modified 2026-04-10

Affected packages

OSV did not name a package on this entry.

Scan your repository

This page is one package or one advisory. A repository scan checks the lockfile, what the code imports, and can open a pull request. Public scans need no account.

CVE-2015-8855 — Scandar