Regular Expression Denial of Service in semver

高危 7.5CVE-2015-8855 · GHSA-x6fg-f45m-jf5q · Published 23/01/2017 · updated 17/06/2026

要点

CVE-2015-8855 是影响 node.js (nodejs), semver 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：6.9%，高于 94.1% 的漏洞。
修复：升级到 4.3.2 或更高版本。

Package	Affected versions	Patched versions
node.js nodejs	`≤ 4.3.1`	No fix yet
semver npm	`≥ 1.0.4, < 4.3.2`	`4.3.2`

Description

Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

Recommendation

Update to version 4.3.2 or later

NVD description

The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

References

nvd.nist.gov/vuln/detail/CVE-2015-8855 · ADVISORY
github/advisory-database#7102 · WEB
npm/node-semver commit 5c4c9f6 · WEB
npm/node-semver commit c80180d · WEB
GitHub Advisory GHSA-x6fg-f45m-jf5q · ADVISORY
npm/node-semver · PACKAGE
npmjs.com/advisories/31 · WEB
owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS · WEB
openwall.com/lists/oss-security/2016/04/20/11 · WEB
securityfocus.com/bid/86957 · WEB
nodesecurity.io/advisories/31 · Patch

node.js 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

node.js

nodejs

≤ 4.3.1

No fix yet

semver

npm

≥ 1.0.4, < 4.3.2

4.3.2

Description

Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

Recommendation

Update to version 4.3.2 or later

NVD description

The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

node.js 的其他漏洞

查看全部 →