Vulnerability Database

300,214

Total vulnerabilities in the database

CVE-2019-2391

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.

Published: Mar 31, 2020
Updated: Nov 9, 2025
CVE: CVE-2019-2391
GHSA: GHSA-4jwp-vfvf-657p
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.2
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CVSS v2:

Severity: Medium
Score: 5.5
AV:N/AC:L/Au:S/C:P/I:P/A:N

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
mongodb / js-bson	-	1.1.4
bson	-	1.1.4

https://github.com/mongodb/js-bson/releases/tag/v1.1.4

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo