Regular Expression Denial of Service in uglify-js

Description

Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.

Recommendation

Update the uglify-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.6.0
• Patched version(s): 2.6.0

References

• GHSA-c9f4-xj24-8jqx
• www.npmjs.com
• www.openwall.com
• www.securityfocus.com
• CVE-2015-8858
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in marked - CVE-2015-8854
• Regular Expression Denial of Service in ms - CVE-2015-8315
• angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844
• Regular Expression Denial of Service (ReDoS) in lodash - CVE-2020-28500

Tags:

npm

uglify-js