{"api_version":"1","generated_at":"2026-07-23T04:32:56+00:00","cve":"CVE-2015-5380","urls":{"html":"https://cve.report/CVE-2015-5380","api":"https://cve.report/api/cve/CVE-2015-5380.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-5380","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-5380"},"summary":{"title":"CVE-2015-5380","description":"The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-07-09 10:59:00","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/75556","name":"http://www.securityfocus.com/bid/75556","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Node.js 'unicode.cc' Denial of Service Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://codereview.chromium.org/1226493003","name":"https://codereview.chromium.org/1226493003","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Issue 1226493003: unicode-decoder: fix out-of-band write in utf16 -\n    \n    Code Review","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852","name":"https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Important security upgrades for node.js and io.js — Node & JavaScript — Medium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/joyent/node/issues/25583","name":"https://github.com/joyent/node/issues/25583","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Segfault on node 0.12.4, to do with unicode and buffers · Issue #25583 · joyent/node · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/","name":"http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Node v0.12.6 (Stable) | Node.js","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://medium.com/@iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852","name":"CONFIRM:https://medium.com/@iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852","refsource":"MITRE","tags":[],"title":"Important security upgrades for node.js and io.js — Node & JavaScript — Medium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5380","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5380","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"v8","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"2.3.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"1.8.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"iojs","cpe5":"io.js","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5380","vulnerable":"1","versionEndIncluding":"0.12.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nodejs","cpe5":"node.js","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2015-5380","qid":"690322","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for node, iojs, and v8 (864e6f75-2372-11e5-86ff-14dae9d210b8)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T06:50:02.366Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://codereview.chromium.org/1226493003"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/joyent/node/issues/25583"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/"},{"name":"75556","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/75556"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-07-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-11-25T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://codereview.chromium.org/1226493003"},{"tags":["x_refsource_CONFIRM"],"url":"https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/joyent/node/issues/25583"},{"tags":["x_refsource_CONFIRM"],"url":"http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/"},{"name":"75556","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/75556"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-5380","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://codereview.chromium.org/1226493003","refsource":"CONFIRM","url":"https://codereview.chromium.org/1226493003"},{"name":"https://medium.com/@iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852","refsource":"CONFIRM","url":"https://medium.com/@iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852"},{"name":"https://github.com/joyent/node/issues/25583","refsource":"CONFIRM","url":"https://github.com/joyent/node/issues/25583"},{"name":"http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/","refsource":"CONFIRM","url":"http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/"},{"name":"75556","refsource":"BID","url":"http://www.securityfocus.com/bid/75556"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-5380","datePublished":"2015-07-09T10:00:00.000Z","dateReserved":"2015-07-06T00:00:00.000Z","dateUpdated":"2024-08-06T06:50:02.366Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-07-09 10:59:00","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:v8:-:*:*:*:*:*:*:*","matchCriteriaId":"7900AA49-FCFE-4068-BA49-50EA0B53C4CF"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.2","matchCriteriaId":"A3188BB5-6918-455C-8D25-B4DBA22830D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"FABEE90B-14C3-4147-BBDA-6E1186452174"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"2FF9263D-673F-40A4-8D40-56DE5AD63B73"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"52BE5478-4021-42D4-B101-A572AAE17DAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"2233DADC-4FBB-4459-AD8D-B15636DC5970"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"72CC13EF-7061-4833-A079-EAB70A32F64B"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.2.1:*:*:*:*:*:*:*","matchCriteriaId":"BA4A14A1-1D14-4CE8-9198-80C1772A8AC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.3.0:*:*:*:*:*:*:*","matchCriteriaId":"A9D2B3E1-973D-46ED-ADE4-BECE0CAFD678"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.3.1:*:*:*:*:*:*:*","matchCriteriaId":"8261E351-8CB2-4BCB-AB75-9FDD96DC2BA3"},{"vulnerable":true,"criteria":"cpe:2.3:a:iojs:io.js:2.3.2:*:*:*:*:*:*:*","matchCriteriaId":"C236FE4E-1FF0-47E5-91F9-75ADD6C61498"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","versionEndIncluding":"0.12.5","matchCriteriaId":"4BCBBCD4-2142-44B7-B3ED-6D2A301F85C6"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"5380","Ordinal":"1","Title":"CVE-2015-5380","CVE":"CVE-2015-5380","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"5380","Ordinal":"1","NoteData":"The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.","Type":"Description","Title":"CVE-2015-5380"},{"CveYear":"2015","CveId":"5380","Ordinal":"2","NoteData":"2015-07-09","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"5380","Ordinal":"3","NoteData":"2016-11-25","Type":"Other","Title":"Modified"}]}}}