Remote Memory Exposure in mongoose

GHSA-r5xw-q988-826m

Published Sep 1, 2020 · Modified Dec 7, 2023

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.

Recommendation

Update to version 4.3.6, 3.8.39 or later.

References

WEB https://github.com/Automattic/mongoose/issues/3764
WEB https://gist.github.com/ChALkeR/440bc3dfcbd9b6da75c3
WEB https://gist.github.com/ChALkeR/d4a8055625221b6e65f0
WEB https://www.npmjs.com/advisories/599

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes