{
"id": "GHSA-r5xw-q988-826m",
"aliases": [],
"details": "Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.\n\nTrying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.\n\n\n## Recommendation\n\nUpdate to version 4.3.6, 3.8.39 or later.",
"summary": "Remote Memory Exposure in mongoose",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.5.5"
},
{
"fixed": "3.8.39"
}
]
}
],
"package": {
"name": "mongoose",
"ecosystem": "npm"
},
"database_specific": {
"last_known_affected_version_range": "<= 3.8.38"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.6"
}
]
}
],
"package": {
"name": "mongoose",
"ecosystem": "npm"
},
"database_specific": {
"last_known_affected_version_range": "<= 4.3.5"
}
}
],
"modified": "2023-12-07T22:05:28Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"published": "2020-09-01T19:39:37Z",
"references": [
{
"url": "https://github.com/Automattic/mongoose/issues/3764",
"type": "WEB"
},
{
"url": "https://gist.github.com/ChALkeR/440bc3dfcbd9b6da75c3",
"type": "WEB"
},
{
"url": "https://gist.github.com/ChALkeR/d4a8055625221b6e65f0",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/advisories/599",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-201"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-08-31T18:29:22Z"
}
}