CVE-2019-2391: Deserialization of Untrusted Data in bson
Summary
CVE-2019-2391: Deserialization of Untrusted Data in bson. Affects bson versions < 1.1.4. Fixed in 1.1.4. How to fix ↓
Also tracked for
- node-mongodb · Debian:11
The same CVE-2019-2391 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'bson' package is an npm package used for serializing and deserializing BSON (Binary JSON) data. BSON is a binary representation of JSON-like documents and is commonly used in MongoDB. The package provides functions for converting JavaScript objects to BSON and vice versa. However, a vulnerability has been discovered in the package that allows for incorrect parsing of certain JSON input, leading to js-bson not correctly serializing BSON. This can result in unexpected application behavior, including potential data disclosure.
Vulnerability Detail
The vulnerability (CVE-2019-2391) originates from the incorrect parsing of specific JSON input in the 'bson' package. This incorrect parsing can cause the js-bson library to fail in correctly serializing BSON data. As a result, applications using this package may exhibit unexpected behavior, potentially leading to data disclosure. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 7.3.3 as of 22 Oct 2026
npm install bson@7.3.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.4
This is the first release that contains the fix.
npm install bson@1.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating the 'bson' package to the fixed version is the recommended solution.
Conclusion
In conclusion, the 'bson' package is vulnerable to a deserialization issue that can lead to incorrect serialization of BSON data and unexpected application behavior. To mitigate this vulnerability, it is crucial to update the package to version 1.1.4 or higher. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bson →
FAQ
The 'bson' package is an npm package used for serializing and deserializing BSON (Binary JSON) data. BSON is commonly used in MongoDB for efficient storage and retrieval of data.
The vulnerability in the 'bson' package can result in incorrect serialization of BSON data, leading to unexpected application behavior and potential data disclosure.
To fix this vulnerability, update the 'bson' package to version 1.1.4 or higher using the command 'npm install bson@1.1.4'.
No specific workaround is provided for this vulnerability. Updating the 'bson' package is the recommended solution.
The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bson.
