Executive brief
The uglify-js library, a popular tool for compressing and optimizing JavaScript code, is vulnerable to a denial-of-service attack. By providing specially crafted input to the parser, an attacker can cause the system to consume excessive CPU resources, potentially leading to application crashes or service outages. This affects developers and automated build systems that process untrusted JavaScript code.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the uglify-js package before version 2.6.0. The flaw is located within the parsing logic, where certain crafted inputs trigger catastrophic backtracking in regular expression evaluation. This allows a remote, unauthenticated attacker to cause high CPU consumption and a denial-of-service condition by submitting malicious JavaScript code to be processed by the library. The issue is resolved in version 2.6.0.
Affected products
- uglifyjs_project uglify-js < 2.6.0
Timeline
- 2015-08-24: disclosed: Approximate date based on CVE assignment year and related advisories
- 2017-01-23: advisory: NVD publication date