CVE-2020-7610: Deserialization of Untrusted Data in bson
Summary
CVE-2020-7610: Deserialization of Untrusted Data in bson. Affects bson versions < 1.1.4. Fixed in 1.1.4. How to fix ↓
Also tracked for
- node-mongodb · Debian:11
The same CVE-2020-7610 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bson package is an npm package used for working with BSON (Binary JSON) data in JavaScript. BSON is a binary representation of JSON-like documents, commonly used in MongoDB. The package provides functions for serializing and deserializing BSON data. However, all versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. This vulnerability occurs when the package ignores an unknown value for an object's _bsontype, causing an object to be serialized as a document instead of the intended BSON type.
Vulnerability Detail
The vulnerability in bson allows an attacker to provide malicious input that can be deserialized by the package. By exploiting this vulnerability, an attacker can potentially execute arbitrary code or perform other malicious actions on the system. The impact of this vulnerability can be severe, as it allows for remote code execution and unauthorized access to sensitive data. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 7.3.3 as of 22 Oct 2026
npm install bson@7.3.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.4
This is the first release that contains the fix.
npm install bson@1.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of bson to mitigate the risk.
Conclusion
The bson package before version 1.1.4 is vulnerable to Deserialization of Untrusted Data. This vulnerability can lead to remote code execution and unauthorized access to sensitive data. It is crucial to upgrade to bson version 1.1.4 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for bson →
FAQ
BSON is a binary representation of JSON-like documents, commonly used in MongoDB. The bson package provides functions for working with BSON data in JavaScript.
The vulnerability allows for remote code execution and unauthorized access to sensitive data. An attacker can exploit this vulnerability to execute arbitrary code or perform other malicious actions on the system.
To fix this vulnerability, you need to upgrade to bson version 1.1.4 or later. Update your package.json file to specify the latest version of bson as a dependency and install the updated version using the package manager.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of bson to mitigate the risk.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-v8w9-2789-6hhr/GHSA-v8w9-2789-6hhr.json
References
Related vulnerabilities
Recent vulnerabilities recorded for bson.
