Regular Expression Denial of Service in uglify-js

Description

Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.

Recommendation

Update the uglify-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.6.0
• Patched version(s): 2.6.0

References

• GHSA-c9f4-xj24-8jqx
• www.npmjs.com
• www.openwall.com
• www.securityfocus.com
• CVE-2015-8858
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service in marked - CVE-2015-8854
• Regular Expression Denial of Service in ms - CVE-2015-8315
• Regular Expression Denial of Service in slug - CVE-2017-16117
• markdown-it is has a Regular Expression Denial of Service (ReDoS) - CVE-2026-2327

Tags:

npm

uglify-js