Critical JSON Parsing Vulnerability in node-mongodb Package
Summary
DEBIAN-CVE-2019-2391: Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. Affects node-mongodb versions < 3.5.6+~cs11.12.19-1. Fixed in 3.5.6+~cs11.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-mongodb package is a library that facilitates interaction with MongoDB databases in Node.js applications. It provides essential functionalities for connecting to MongoDB, executing queries, and managing data. However, a vulnerability has been identified in this package that affects its ability to correctly parse certain JSON inputs, potentially leading to serious security issues.
Vulnerability Detail
The vulnerability arises from incorrect parsing of specific JSON input, which may result in the js-bson library (used by MongoDB) not properly serializing BSON data. This flaw can lead to unexpected application behavior, including potential data disclosure, where sensitive information may be exposed to unauthorized users. The issue affects versions of the js-bson library up to and including 1.1.3.
How To Fix
Minimum fixed version
3.5.6+~cs11.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mongodbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize JSON data before processing it. This can help mitigate the risk of malformed JSON inputs causing issues.
Conclusion
In summary, the node-mongodb package has a critical vulnerability due to incorrect JSON parsing, which can lead to data disclosure. It is essential to update to the fixed version to ensure the security of your application. Implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for node-mongodb →
FAQ
The vulnerability can lead to unexpected application behavior and potential data disclosure, compromising the security of sensitive information.
The vulnerability affects all versions of node-mongodb prior to 3.5.6+~cs11.12.19-1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Yes, implementing input validation to sanitize JSON data can help reduce the risk associated with this vulnerability.
js-bson is a library used by MongoDB for BSON serialization. The vulnerability in node-mongodb affects how js-bson handles certain JSON inputs, leading to potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mongodb.
