GHSA-v8w9-2789-6hhrCriticalCVSS 9.8

Deserialization of Untrusted Data in bson

Published
May 7, 2021
Last Modified
February 12, 2025

🔗 CVE IDs covered (1)

CVE-2020-7610 →

📋 Description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.

🎯 Affected products1

  • npm/bson:< 1.1.4

🔗 References (4)