p PatchFirst

GHSA-r5xw-q988-826m

GHSA-r5xw-q988-826m · Remote Memory Exposure in mongoose

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database. ## Recommendation Update to version 4.3.6, 3.8.39 or later.

CVSS 5.1 · Medium · Fix available

Published
Updated

Stack: node

Affected products and versions

  • mongoose npm

    Affected ranges
    • SEMVER: ≥ 3.5.5, < 3.8.39

    Update to 3.8.39

  • mongoose npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 4.3.6

    Update to 4.3.6

Original sources

Check your server →