HIGH7.5

GHSA-8462-q7x7-g2x4

js-bson vulnerable to REDoS

Quick fix

GHSA-8462-q7x7-g2x4 — bson: upgrade to the fixed version with the command below.

npm install bson@1.0.5

Details

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/bson

Introduced in: 0.5.0Fixed in: 1.0.5

Fixnpm install bson@1.0.5

References

https://nvd.nist.gov/vuln/detail/CVE-2018-13863[ADVISORY]
https://github.com/mongodb/js-bson/commit/bd61c45157c53a1698ff23770160cf4783e9ea4a[WEB]
https://github.com/advisories/GHSA-8462-q7x7-g2x4[ADVISORY]
https://github.com/mongodb/js-bson[PACKAGE]
https://snyk.io/vuln/npm:bson:20180225[WEB]