CVE-2015-8855: Node.js

High severity, CVSS 7.5. EPSS: 6.7% chance of exploitation in the next 30 days.

The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

Affected products

• Node.js Node.js: up to and including 4.3.1

Published 2017-01-23. Last modified 2026-06-17.