Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js (GHSA-34r7-q49f-h37c)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-8857
Severity: CRITICAL · CWE: CWE-1254
CWE-670

Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.

## Recommendation

Upgrade UglifyJS to version >= 2.4.24.

Affected packages:
package: ecosystem: npm
name: uglify-js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.24
package: ecosystem: RubyGems
name: uglifier
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.7.2