GitHub Advisoryadvisory · npm

GHSA-8462-q7x7-g2x4 js-bson vulnerable to REDoS

HIGH Published 2018-09-17 Modified 2023-09-05 Official page ↗
Aliases
CVE-2018-13863
Ecosystem
npm
Packages
bson
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-185, CWE-400
Reviewed
2020-06-16

Affected packages

• npm bson: >= 0.5.0, < 1.0.5 → fixed in 1.0.5

Description

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.

Related

Alias · CVE (1)

  • CVE-2018-13863 The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression… vulnerability

Weakness · CWE (2)

  • CWE-185 Incorrect Regular Expression weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References