Deserialization of Untrusted Data in bson (GHSA-4jwp-vfvf-657p)

Description

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.

Recommendation

Update the bson package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-4jwp-vfvf-657p
• CVE-2019-2391
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Deserialization of Untrusted Data in bson - CVE-2020-7610
• Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
• XSS vulnerability that affects bootstrap (GHSA-3mgp-fx93-9xv5) - CVE-2018-20676
• follow-redirects' Proxy-Authorization header kept across hosts - CVE-2024-28849

Tags:

npm

bson