CVE-2015-8857

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-01-23

Last modified

2024-08-06

Weaknesses

CWE-254

Affected products

• Uglifyjs (Uglifyjs Project)

References

• http://www.openwall.com/lists/oss-security/2016/04/20/11
• http://www.securityfocus.com/bid/96410
• https://nodesecurity.io/advisories/39