CVE-2015-8857: Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

October 24, 2017 (updated October 29, 2021)

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

References

www.openwall.com/lists/oss-security/2016/04/20/11
www.securityfocus.com/bid/96410
github.com/advisories/GHSA-34r7-q49f-h37c
github.com/mishoo/UglifyJS2/issues/751
nodesecurity.io/advisories/39
nvd.nist.gov/vuln/detail/CVE-2015-8857
www.npmjs.com/advisories/39
zyan.scripts.mit.edu/blog/backdooring-js/

Detect and mitigate CVE-2015-8857 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →