CVE-2015-8858

High

Published: 23/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a 'regular expression denial of service (ReDoS).'

Risk Assessment

Attackers can exploit this vulnerability to overload the server, leading to decreased application performance and potential downtime.

Recommendation

It is recommended to update the uglify-js package to version 2.6.0 or later to mitigate the risk associated with this vulnerability.

Other vulnerabilities in uglify-js

CVE-2015-8857Critical
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms.

Original NVD description (English source)

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."