GHSA-8462-q7x7-g2x4HighCVSS 7.5

js-bson vulnerable to REDoS

Published
September 17, 2018
Last Modified
September 5, 2023

🔗 CVE IDs covered (1)

CVE-2018-13863 →

📋 Description

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.

🎯 Affected products1

  • npm/bson:>= 0.5.0, < 1.0.5

🔗 References (4)