Vulnerability Database

296,416

Total vulnerabilities in the database

Remote Memory Exposure in mongoose

Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.

Recommendation

Update to version 4.3.6, 3.8.39 or later.

CVSS v3:

  • Severity: Unknown
  • Score:
  • AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/

CWEs: