CVE-2015-8855: The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption)...

Security readout for executives and security teams

This is a denial-of-service flaw in Node.js semver before 4.3.2. A very long version string can make regex parsing consume excessive CPU. Business risk depends on whether an application parses attacker-supplied version text. The source bundle does not show active exploitation or CVSS severity. Exposure is most likely in Node.js applications or build tooling that include semver versions before 4.3.2 and process untrusted or externally influenced version strings. Internal-only package parsing lowers urgency; internet-facing or API-driven parsing raises it. Address during normal dependency maintenance unless exposed in public request handling. Escalate if customer-controlled version data reaches semver parsing in production services, because the impact is service degradation rather than data theft. Mitigation focus: Inventory Node.js projects using semver before 4.3.2.; Update semver to 4.3.2 or later where compatible.; Check vendor or maintainer guidance for supported upgrade paths..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.