MEDIUM5.4

GHSA-4jwp-vfvf-657p

Deserialization of Untrusted Data in bson

Quick fix

GHSA-4jwp-vfvf-657p — bson: upgrade to the fixed version with the command below.

npm install bson@1.1.4

Details

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/bson

Introduced in: 0Fixed in: 1.1.4

Fixnpm install bson@1.1.4

References

https://nvd.nist.gov/vuln/detail/CVE-2019-2391[ADVISORY]
https://github.com/mongodb/js-bson[PACKAGE]
https://github.com/mongodb/js-bson/releases/tag/v1.1.4[WEB]