High · 7.5 CVE-2015-8858 EUVD-2017-0215GHSA-c9f4-xj24-8jqx

Regular Expression Denial of Service in uglify-js

Published Jan 23, 2017 · Updated Aug 6, 2024 · Assigned by mitre

Package: uglify-js Package: uglifyjs Package: uglifyjs Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 13	uglifyjs	2.7.4-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	uglifyjs	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	uglify-js	< 2.6.0	2.6.0	GHSA-c9f4-xj24-8jqx

References

96409 vdb-entry
https://nodesecurity.io/advisories/48
[oss-security] 20160420 various vulnerabilities in Node.js packages mailing-list