CVE-2015-8027

Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.

• CWE-17

• http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.html
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV79524Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21972419Vendor Advisory
• http://www.securityfocus.com/bid/78207
• https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764/Vendor Advisory
• https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/Vendor Advisory
• https://security.gentoo.org/glsa/201612-43
• http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.html
• http://www-01.ibm.com/support/docview.wss?uid=swg1IV79524Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21972419Vendor Advisory
• http://www.securityfocus.com/bid/78207
• https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764/Vendor Advisory
• https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/Vendor Advisory
• https://security.gentoo.org/glsa/201612-43

Published

Jan 2, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8021Incomplete blacklist vulnerability in the Configuration util…
• CVE-2015-8022The Configuration utility in F5 BIG-IP LTM, Analytics, APM, …
• CVE-2015-8023The server implementation of the EAP-MSCHAPv2 protocol in th…
• CVE-2015-8024McAfee Enterprise Security Manager (ESM), Enterprise Securit…
• CVE-2015-8025driver/subprocs.c in XScreenSaver before 5.34 does not prope…
• CVE-2015-8026Heap-based buffer overflow in the verify_vbr_checksum functi…7.8
• CVE-2015-8028Multiple buffer overflows in SAP 3D Visual Enterprise Viewer…
• CVE-2015-8029SAP 3D Visual Enterprise Viewer (VEV) allows remote attacker…
• CVE-2015-8030SAP 3D Visual Enterprise Viewer (VEV) allows remote attacker…
• CVE-2015-8031Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 …9.8
• CVE-2015-8032In Textpattern 4.5.7, an unprivileged author can change an a…5.3
• CVE-2015-8033In Textpattern 4.5.7, the password-reset feature does not se…5.3