Skip to content
OpenAdvisories
High USN-4776-1 1 CVE

node-semver vulnerability

Published Mar 15, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that semver incorrectly handled certain inputs. A remote
attacker could possibly use this issue to cause a denial of service.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS node-semver 2.1.0-2ubuntu0.0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS node-semver 2.1.0-2ubuntu0.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2015-8855

    Regular Expression Denial of Service in semver

    The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

    semver node-semver node-semver Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2015-8855