GitHub Advisoryadvisory · npm

GHSA-mhxj-85r3-2x55 file-type vulnerable to Infinite Loop via malformed MKV file

HIGH Published 2022-07-22 Modified 2022-08-16 Official page ↗
Aliases
CVE-2022-36313
Ecosystem
npm
Packages
file-type
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2022-07-22

Affected packages

• npm file-type: >= 13.0.0, < 16.5.4 → fixed in 16.5.4 • npm file-type: >= 17.0.0, < 17.1.3 → fixed in 17.1.3

Description

An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when used on a web server.

Related

Alias · CVE (1)

  • CVE-2022-36313 An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References