CVE-2015-5380: The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before...

Security readout for executives and security teams

This is an old Node.js/io.js memory handling flaw in V8 UTF-8 decoding. A remote attacker could send specially formed text data that may crash the process or cause memory corruption. The sources do not show active exploitation, but any remaining legacy runtime is unsupported and should be treated as technical debt with operational risk. Exposure is most likely in legacy services still running the named Node.js or io.js versions, especially internet-facing applications that decode untrusted UTF-8 input. Products embedding the vulnerable V8 code may also be affected, but the bundle does not identify specific third-party products. Treat this as a legacy exposure cleanup item unless affected runtimes remain in production. If found on internet-facing systems, prioritize removal because the flaw can remotely disrupt service and involves memory corruption. Mitigation focus: Upgrade Node.js to 0.12.6 or later where applicable.; Upgrade io.js to 1.8.3, or 2.x to 2.3.3 or later.; Replace unsupported Node.js or io.js runtimes with maintained releases..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.