Deserialization of Untrusted Data in bson

Description

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object’s _bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Recommendation

Update the bson package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-v8w9-2789-6hhr
• snyk.io
• CVE-2020-7610
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• node-forge has ASN.1 Unbounded Recursion - CVE-2025-66031
• Cross-site scripting in bootstrap-select - CVE-2019-20921
• XSS vulnerability that affects bootstrap - CVE-2018-20676
• Server-Side Template Injection in formio - CVE-2020-28246

Tags:

npm

bson