What is GHSA-r5xw-q988-826m?

GHSA-r5xw-q988-826m is a security advisory published by GitHub Security Advisories with Medium severity. Remote Memory Exposure in mongoose

Why does GHSA-r5xw-q988-826m have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-r5xw-q988-826m?

GHSA-r5xw-q988-826m has a CVSS v3 base score of 5.1, published by GitHub Security Advisories.

Which products are affected by GHSA-r5xw-q988-826m?

GHSA-r5xw-q988-826m affects 2 products, including: npm/mongoose:\u003e= 3.5.5, \u003c= 3.8.38; npm/mongoose:\u003e= 4.0.0, \u003c= 4.3.5.

GHSA-r5xw-q988-826mMediumCVSS 5.1Disclosed before NVD

Remote Memory Exposure in mongoose

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

December 7, 2023

📋 Description

Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.

Recommendation

Update to version 4.3.6, 3.8.39 or later.

🎯 Affected products2

npm/mongoose:>= 3.5.5, <= 3.8.38
npm/mongoose:>= 4.0.0, <= 4.3.5

🔗 References (5)

https://github.com/Automattic/mongoose/issues/3764
https://gist.github.com/ChALkeR/440bc3dfcbd9b6da75c3
https://gist.github.com/ChALkeR/d4a8055625221b6e65f0
https://www.npmjs.com/advisories/599
https://github.com/advisories/GHSA-r5xw-q988-826m