PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8857 Uglifyjs Project CVE debrief

CVE-2015-8857 affects uglify-js versions before 2.4.24. The issue is in how the package rewrites boolean expressions: non-boolean values were not properly accounted for, which could change program logic in a way that bypasses intended security controls or causes other incorrect behavior. Because uglify-js is commonly used in Node.js build and release pipelines, the practical risk is that transformed JavaScript may not preserve the original security assumptions.

Vendor
Uglifyjs Project
Product
Uglifyjs
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Node.js maintainers, frontend/backend teams that use uglify-js in build pipelines, release engineering teams, and security teams that rely on minified or transformed JavaScript preserving exact boolean logic.

Technical summary

According to NVD and the linked advisories, uglify-js before 2.4.24 improperly handled non-boolean values during boolean-expression rewriting. That can lead to unsafe or incorrect output JavaScript, especially where code transformation changes how security-related conditions evaluate. NVD maps the issue to CWE-254 and rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Defensive priority

Critical. The CVSS score is 9.8 and the issue can affect security-sensitive logic without requiring privileges or user interaction. Treat as a high-priority dependency update if uglify-js is present in any active build path.

Recommended defensive actions

  • Upgrade uglify-js to version 2.4.24 or later.
  • Inventory build and release pipelines for direct or transitive uglify-js use.
  • Rebuild and retest any artifacts produced with affected versions, especially where boolean logic influences access control or feature gating.
  • Pin or lock dependency versions to prevent reintroduction of vulnerable releases.
  • Review downstream bundles or generated JavaScript for unexpected logic changes after minification/transformation.
  • Monitor the linked advisories and your dependency tooling for any affected package variants or forks.

Evidence notes

The NVD record states that uglify-js before 2.4.24 does not properly account for non-boolean values when rewriting boolean expressions, with possible security bypass impact. NVD assigns CVSS 3.1 9.8 and CWE-254. The source references include the Node Security advisory (nodesecurity.io/advisories/39), an oss-security mailing list post dated 2016-04-20, and a SecurityFocus VDB entry. The CVE was published on 2017-01-23.

Official resources

The CVE was published on 2017-01-23. The referenced advisories in the source corpus date back to 2016-04-20, showing the issue was publicly discussed before CVE publication. This debrief uses the CVE published date for disclosure timing and