GHSA-r5xw-q988-826m Remote Memory Exposure in mongoose
Attackers can expose uninitialized memory by saving numbers to Buffer fields, potentially leaking sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-r5xw-q988-826m?
GHSA-r5xw-q988-826m is a vulnerability in mongoose, published on 1 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.
Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.
Recommendation
Update to version 4.3.6, 3.8.39 or later.
Which versions are affected by GHSA-r5xw-q988-826m?
4 open source packages ship an affected version, including mongoose.
| Package | Affected | Fixed in |
|---|---|---|
mongoose npm | From 3.5.5 | 3.8.39 |
mongoose npm | From 3.5.5 | 3.8.39 |
mongoose npm | From 4.0.0 | 4.3.6 |
mongoose npm | From 4.0.0 | 4.3.6 |
How do I fix GHSA-r5xw-q988-826m?
Upgrade mongoose to a fixed version for your release line: 3.8.39 or 4.3.6.
Is GHSA-r5xw-q988-826m being exploited?
There is no known exploitation of GHSA-r5xw-q988-826m in the wild and no public exploit code.