CVE-2020-8237: Uncontrolled Resource Consumption in json-bigint
Summary
CVE-2020-8237: Uncontrolled Resource Consumption in json-bigint. Affects json-bigint versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-bigint package is an npm package that provides a way to handle large integers in JSON. It allows parsing and stringifying JSON objects with large integer values. This package is commonly used in JavaScript applications that require working with big integers. Unfortunately, versions of json-bigint prior to 1.0.0 are vulnerable to prototype pollution, which can lead to a denial-of-service (DoS) attack.
Vulnerability Detail
The vulnerability in json-bigint arises from prototype pollution. By manipulating the JSON input, an attacker can modify the prototype of JSON objects, leading to unexpected behavior and potential DoS attacks. This can result in excessive resource consumption, causing the application to become unresponsive or crash. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
npm install json-bigint@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of json-bigint to mitigate the risk.
Conclusion
The json-bigint package prior to version 1.0.0 is vulnerable to prototype pollution, which can lead to a denial-of-service attack. To mitigate this risk, it is important to upgrade to json-bigint version 1.0.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json-bigint →
FAQ
Json-bigint is an npm package that allows handling large integers in JSON.
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of objects, leading to unexpected behavior and potential security issues.
The vulnerability in json-bigint can result in a denial-of-service (DoS) attack, causing excessive resource consumption and potentially crashing the application.
To fix this vulnerability, it is recommended to upgrade to json-bigint version 1.0.0 or later.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of json-bigint.
