CVE-2015-8315: Regular Expression Denial of Service in ms
Summary
CVE-2015-8315: Regular Expression Denial of Service in ms. Affects ms versions < 0.7.1. Fixed in 0.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ms package is an npm package that provides a simple utility for converting various time formats to milliseconds. It is commonly used in JavaScript applications to handle time-related operations. However, versions of ms prior to 0.7.1 are vulnerable to a regular expression denial of service (ReDoS) attack when parsing extremely long version strings.
Vulnerability Detail
The vulnerability in the ms package allows an attacker to cause a denial of service (DoS) by providing an excessively long version string. When such a string is parsed, the regular expression used by the package to validate and parse the input becomes highly inefficient, leading to a significant increase in execution time. This can result in the application becoming unresponsive or consuming excessive resources. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 2.1.3 as of 22 Oct 2026
npm install ms@2.1.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.1
This is the first release that contains the fix.
npm install ms@0.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the ms package is not immediately feasible, developers can implement input validation to limit the length of the version string before passing it to the ms package. This can help mitigate the risk of a denial of service attack. Here's an example of how to implement input validation in JavaScript:
function validateVersionString(version) {
if (version.length > 100) {
throw new Error('Invalid version string');
}
}
validateVersionString(userInput);
Conclusion
The ms package prior to version 0.7.1 is vulnerable to a regular expression denial of service attack. Developers should update to the latest version of the package to mitigate this vulnerability. If immediate update is not possible, implementing input validation can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ms →
FAQ
The ms package is an npm package that provides a utility for converting time formats to milliseconds. It is commonly used in JavaScript applications for time-related operations.
A regular expression denial of service (ReDoS) attack is a type of denial of service attack where an attacker provides input that causes a regular expression to take an excessive amount of time to evaluate. This can lead to a significant impact on the performance and availability of the targeted system.
The regular expression denial of service vulnerability in the ms package can result in a denial of service (DoS) condition, causing the application to become unresponsive or consume excessive resources. This can lead to a degraded user experience and potential disruption of service.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities.
Yes, if updating the ms package is not immediately feasible, you can implement input validation to limit the length of the version string before passing it to the ms package. This can help mitigate the risk of a denial of service attack. Refer to the 'workaround' section for an example of how to implement input validation in JavaScript.
Related vulnerabilities
Recent vulnerabilities recorded for ms.
