In short
- CVE-2015-8857 is a CRITICAL (CVSS 9.8) vulnerability affecting uglifier, uglifyjs (uglifyjs project), uglify-js.
- Chance of exploitation in the next 30 days (EPSS): 3.6%, higher than 89.4% of all vulnerabilities.
- Fix: update to 2.7.2, 2.4.24 or later.
Description
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Recommendation
Upgrade UglifyJS to version >= 2.4.24.
NVD description
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free