CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2015-8858
High (7.5) in uglifyjs project uglifyjs. EPSS 2.4% chance of exploitation in the next 30 days. Fixed in uglify-js 2.6.0.
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
Severity
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-399
- Published
- Modified
- Record from
- the NVD, synced
Affected
- uglifyjs_project:uglifyjs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c9f4-xj24-8jqx | npm | uglify-js | <2.6.0 | 2.6.0 |