CVE-2022-21164: Unhandled case in node-lmdb leads to Denial of Service
Summary
CVE-2022-21164: Unhandled case in node-lmdb. Affects node-lmdb versions < 0.9.7. Fixed in 0.9.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-lmdb package is an npm package that provides a Node.js binding for the Lightning Memory-Mapped Database (LMDB) library. LMDB is a highly efficient, transactional key-value store that allows multiple processes to access the same database concurrently. The node-lmdb package enables developers to use LMDB in their Node.js applications, providing a simple and efficient interface for database operations. However, versions of node-lmdb before 0.9.7 are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in node-lmdb arises from an unhandled case when defining a non-invokable ToString value. This can lead to a crash during type check operations, resulting in a DoS condition. An attacker can exploit this vulnerability by providing a specially crafted input that triggers the unhandled case, causing the application to crash. The impact of this vulnerability is a disruption of service, potentially leading to downtime and loss of data.
How To Fix
Minimum fixed version
0.9.7
This is the first release that contains the fix.
npm install node-lmdb@0.9.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the node-lmdb package as soon as possible.
Conclusion
The node-lmdb package before version 0.9.7 is vulnerable to a Denial of Service (DoS) attack due to an unhandled case when defining a non-invokable ToString value. To mitigate this vulnerability, it is crucial to update the package to version 0.9.7 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-lmdb →
FAQ
Node-lmdb is an npm package that provides a Node.js binding for the Lightning Memory-Mapped Database (LMDB) library. It allows developers to use LMDB in their Node.js applications for efficient and concurrent database operations.
The vulnerability in node-lmdb can lead to a Denial of Service (DoS) condition, causing the application to crash. This can result in downtime and potential loss of data.
To fix this vulnerability, update your node-lmdb package to version 0.9.7 or later. Run the command 'npm install node-lmdb@0.9.7' in your project directory.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the node-lmdb package.
You can find more information about node-lmdb on the npm package page or the official GitHub repository.
