# UglifyJS improper boolean expression rewriting

Source: https://junglewise.ai/threats/uglifyjs-improper-boolean-expression-rewriting-34503f03  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2018-10-09

UglifyJS is a popular JavaScript minification and compression tool used in web development build pipelines. A vulnerability in versions before 2.4.24 allows attackers to bypass security mechanisms by exploiting improper rewriting of boolean expressions during code minification, potentially enabling malicious code injection or circumvention of security checks in downstream applications.

Technologies: [uglify-js (npm)](https://junglewise.ai/threats/technologies/uglify-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 9 October 2018.

**Which products and versions are affected?** uglify-js (npm) SEMVER:introduced=0,fixed=2.4.24.

**Is there a fix for This vulnerability?** Yes. uglify-js (npm): upgrade to 2.4.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run uglify-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- uglify-js (npm): upgrade to 2.4.24 or later

  ```sh
  npm install uglify-js@2.4.24
  ```


## Technical details

The vulnerability is a logic flaw in UglifyJS's boolean expression rewriting mechanism. The minifier fails to properly account for non-boolean values when transforming boolean expressions, allowing attackers to craft JavaScript that behaves differently after minification. This can enable security bypass (e.g., circumventing access controls or validation logic) or unspecified malicious behavior. The vulnerability affects all versions before 2.4.24, and is fixed in version 2.4.24 and later. Exploitation requires the attacker to control or influence the JavaScript code being minified.

## Affected products

- UglifyJS UglifyJS before 2.4.24

## Timeline

- 2018-10-09: disclosed: Published to GitHub Advisory Database
- 2020-06-17: other: Advisory withdrawn as accidental duplicate publish (refers to CVE-2015-8857)

## Related threats

- [UglifyJS ReDoS in parse call](https://junglewise.ai/threats/cve-2015-8858-uglifyjs-redos-in-parse-call)
- [UglifyJS incorrect boolean expression rewriting](https://junglewise.ai/threats/cve-2015-8857-uglifyjs-incorrect-boolean-expression-rewriting)