CVE-2015-8857: Uglifyjs Project Uglifyjs

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Affected products

• Uglifyjs Project Uglifyjs: before 2.4.24 (fixed in 2.4.24)

Published 2017-01-23. Last modified 2026-06-17.