CVE-2015-8857: The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewri...

Security readout for executives and security teams

CVE-2015-8857 concerns uglify-js, a JavaScript minifier for Node.js. Versions before 2.4.24 could incorrectly rewrite boolean expressions involving non-boolean values. If security logic was changed during minification, an attacker might bypass checks or cause other undefined impact. Exposure is most likely in Node.js projects or build pipelines that depend on uglify-js before 2.4.24 and minify JavaScript containing security-sensitive conditional logic. The source bundle does not identify specific downstream products. Treat this as a dependency hygiene and assurance issue unless local review finds security-sensitive minified logic. Prioritize internet-facing or high-value applications using old JavaScript build chains, but do not assume active exploitation from the provided evidence. Mitigation focus: Identify direct and transitive uglify-js dependencies in Node.js projects.; Update away from uglify-js versions before 2.4.24.; Rebuild minified JavaScript after dependency updates..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.