Packages / mongoose / Security

ModerateVulnerabilityGHSA-r5xw-q988-826mPublished 1 Sep 2020

Remote Memory Exposure in mongoose

Your version

Affected releases · mongoose

  • 4.x4.0.0 – 4.3.5Fixed in 4.3.6
  • 3.x3.5.5 – 3.8.38Fixed in 3.8.39

On 4.x, the newest line:

npm install mongoose@4.3.6
Every release on a timeline
9.x

  1. Not affected

    9.0.0 – 9.11.4

    49 releases, latest

4.x

  1. Affected

    4.0.0 – 4.3.5

    39 releases

  2. Fixed

    4.3.6 – 4.13.21

    125 releases

3.x

  1. Not affected

    3.0.0 – 3.5.4

    18 releases

  2. Affected

    3.5.5 – 3.8.38

    76 releases

  3. Fixed

    3.8.39 – 3.9.7

    10 releases

1016 stable releases of mongoose, oldest to newest, one row per major.

What happens

Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.

Recommendation

Update to version 4.3.6, 3.8.39 or later.