GitHub Advisoryadvisory · npm

GHSA-r5xw-q988-826m Remote Memory Exposure in mongoose

MEDIUM Published 2020-09-01 Modified 2023-12-07 Official page ↗
Ecosystem
npm
Packages
mongoose
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-201
Reviewed
2020-08-31

Affected packages

• npm mongoose: >= 3.5.5, < 3.8.39 → fixed in 3.8.39 • npm mongoose: >= 4.0.0, < 4.3.6 → fixed in 4.3.6

Description

Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database. Recommendation Update to version 4.3.6, 3.8.39 or later.

Related

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References