← Vulnerability feed

Vulnerability record · CVE-2015-5380 · published 9 July 2015

CVE-2015-5380: Google v8 memory buffer overflow vulnerability

Google · V8

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.

7.5 CVSS 2.0 High EPSS 3.0% · top 13.2% CWE-119 · Memory buffer overflow
7.5CVSS 2.0 base score
3.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted byte sequence.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/ Patch
http://www.securityfocus.com/bid/75556
https://codereview.chromium.org/1226493003
https://github.com/joyent/node/issues/25583
https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852
http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/ Patch
http://www.securityfocus.com/bid/75556
https://codereview.chromium.org/1226493003
https://github.com/joyent/node/issues/25583
https://medium.com/%40iojs/important-security-upgrades-for-node-js-and-io-js-8ac14ece5852

Track CVE-2015-5380 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-85046Google Chrome V8 type confusion enables sandboxed remote code executionChrome's V8 JavaScript engine contains a type confusion flaw (CWE-843) fixed in version 152.0.7977.82. A crafted HTML page can trigger the confusion …KEVEPSS 49%analysed7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10.0CVE-2026-21636Nodejs node.js improper access control vulnerabilityA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even …EPSS 0.88%10.0CVE-2015-8548Google v8 vulnerabilityMultiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow attackers to cause a denial o…EPSS 1.2%10.0CVE-2015-0278Fedoraproject fedora vulnerabilitylibuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.EPSS 3.2%10.0CVE-2014-1704Google chrome vulnerabilityMultiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial…EPSS 1.5%9.8CVE-2026-48930Nodejs node.js improper access control vulnerabilityA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolve…EPSS 0.34%9.8CVE-2024-3566Haskell process library command injection vulnerabilityA command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fu…EPSS 6.9%

Source: NIST National Vulnerability Database (record CVE-2015-5380), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.