PatchTheCVECVE-2015-9242: Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will caus
CVE-2015-9242 is a high-severity flaw (CVSS 7.5) affecting ecstatic. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-9242?
ecstatic: upgrade to 1.4.0. Exact commands for each OS are on this page.
Is CVE-2015-9242 being exploited?
CVE-2015-9242 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2015-9242 affect?
CVE-2015-9242 affects ecstatic. Severity is high (CVSS 7.5). Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via
How urgent is CVE-2015-9242?
Priority 52/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2019-10775 HIGH 7.5 MITIGATE ecstatic have a denial of service vulnerability
- CVE-2016-10703 HIGH 7.5 UPGRADE A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm pac