HighGHSA-x6fg-f45m-jf5qCVE-2015-8855
Regular Expression Denial of Service in semver
Published 24 Oct 2017 · Updated 4 Mar 2026
Affected package
semvernpm
- Affected
- >=1.0.4 <4.3.2
- Fixed in
- 4.3.2
Update to the fixed version for your release line, for example:
npm install semver@4.3.2Details
Versions 4.3.1 and earlier of semver are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
Recommendation
Update to version 4.3.2 or later
Is GHSA-x6fg-f45m-jf5q in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected semver, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2015-8855
- Linkgithub.com/github/advisory-database/pull/7102
- Linkgithub.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0
- Linkgithub.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70
- Advisorygithub.com/advisories/GHSA-x6fg-f45m-jf5q
- Packagegithub.com/npm/node-semver
- Linkwww.npmjs.com/advisories/31
- Linkwww.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
- Linkwww.openwall.com/lists/oss-security/2016/04/20/11
- Linkwww.securityfocus.com/bid/86957
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.