CVE-2015-8855: Regular Expression Denial of Service in semver
Summary
CVE-2015-8855: Regular Expression Denial of Service in semver. Affects semver versions < 4.3.2. Fixed in 4.3.2. How to fix ↓
Also tracked for
- node-semver · Debian:11
The same CVE-2015-8855 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The semver package is an open-source library for parsing and comparing semantic version strings. It is commonly used in JavaScript applications to handle versioning of software components. The package provides functions to parse version strings and perform comparison operations based on the parsed versions. However, versions 4.3.1 and earlier of semver are vulnerable to a regular expression denial of service (ReDoS) attack when parsing extremely long version strings.
Vulnerability Detail
The vulnerability in semver arises from the way it handles parsing of version strings using regular expressions. When an attacker provides an exceptionally long version string, the regular expression used by semver can exhibit exponential time complexity, leading to a denial of service condition. This can cause the application using semver to become unresponsive or consume excessive CPU resources. The impact of this vulnerability can be severe, as it allows an attacker to disrupt the availability of the affected application.
How To Fix
Latest published version: 7.8.5 as of 22 Oct 2026
npm install semver@7.8.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.2
This is the first release that contains the fix.
npm install semver@4.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the semver package to the fixed version to mitigate the risk of a denial of service attack.
Conclusion
In conclusion, the semver package versions 4.3.1 and earlier are vulnerable to a regular expression denial of service attack. To mitigate this vulnerability, it is crucial to update the package to version 4.3.2 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for semver →
FAQ
The vulnerability allows an attacker to perform a denial of service attack by providing an extremely long version string, causing the affected application to become unresponsive or consume excessive CPU resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the semver package is vulnerable.
No, only versions 4.3.1 and earlier of the semver package are affected. It is recommended to update to version 4.3.2 or later to fix the vulnerability.
No, there is no known workaround for this vulnerability. Updating to the fixed version of the semver package is the recommended solution.
Yes, this vulnerability can be exploited remotely by sending a specially crafted version string to the affected application.
Related vulnerabilities
Recent vulnerabilities recorded for semver.
