Packages / mongodb / Security

HighVulnerabilityGHSA-mh5c-679w-hh4rPublished 3 Sep 2020

Denial of Service in mongodb

Affected releases · mongodb

  • 3.x3.0.0 – 3.1.12Fixed in 3.1.13
  • 2.x and older0.9.1 – 2.2.36No fix, no longer updated

On 3.x, the newest line:

npm install mongodb@3.1.13
7.x

  1. Not affected

    7.0.0 – 7.7.0

    9 releases, latest

3.x

  1. Affected

    3.0.0 – 3.1.12

    25 releases

  2. Fixed

    3.1.13 – 3.7.4

    47 releases

2.x

  1. Affected

    2.0.0 – 2.2.36

    115 releases

1.x

  1. Affected

    1.0.0 – 1.4.40

    94 releases

0.x

  1. Affected

    0.9.1 – 0.9.9

    8 releases

373 stable releases of mongodb, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for mongodb. It is read in your browser and sent nowhere.

What happens

Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.

Recommendation

Upgrade to version 3.1.13 or later.