Description
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
Recommendation
Update the uglify-js package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.6.0
- Patched version(s): 2.6.0
References
- GHSA-c9f4-xj24-8jqx
- www.npmjs.com
- www.openwall.com
- www.securityfocus.com
- CVE-2015-8858
- CWE-1333
- CAPEC-310
- OWASP 2021-A6
Related Issues
- Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
- Potential DoS when using ContextLines integration - Vulnerability
- sanitize-html Information Exposure vulnerability - CVE-2024-21501
- json-schema-ref-parser Prototype Pollution issue - CVE-2024-29651
- Tags:
- npm
- uglify-js
Anything's wrong? Let us know Last updated on April 11, 2023