CVE Catalog
CVE-2015-8857
CriticalSummary
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms.
Risk Assessment
The organization may be exposed to attacks that exploit improperly rewritten JavaScript, potentially leading to unspecified impacts.
Recommendation
It is recommended to update the uglify-js package to version 2.4.24 or later to mitigate the risk associated with this vulnerability.
Original NVD description (English source)
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.