Deserialization of Untrusted Data in bson

Description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object’s _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Recommendation

Update the bson package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-v8w9-2789-6hhr
• snyk.io
• CVE-2020-7610
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Deserialization of Untrusted Data in bson (GHSA-4jwp-vfvf-657p) - CVE-2019-2391
• Sensitive data exposure in NATS (GHSA-82rf-q3pr-4f6p) - CVE-2020-26149
• Sensitive data exposure in NATS - CVE-2020-26149
• Prototype Pollution in js-data - CVE-2020-28442

Tags:

npm

bson