CVE-2015-8857
Critical
Description
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
SeverityCritical
CVSS9.8
Exploit probability—
ProductUglify-js
PublishedJan 23, 2017
First seenJan 23, 2017
How to fix
Update
- uglify-js2.4.24 or later
- uglifyjs_project uglifyjs2.4.24 or later
- uglifier2.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| uglify-jsnpm | v < 2.4.24 | 2.4.24 |
| uglifyjs_project uglifyjs | v < 2.4.24 | 2.4.24 |
| uglifierRubyGems | v < 2.7.2 | 2.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.