CVE-2019-2391: Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data…

PriorityP425medium5.4CVSS 3.1

AVNACLPRLUINSUCLILAN

EPSS

0.91%

56.4th percentile

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	node-mongodb	< node-mongodb 3.5.6+~cs11.12.19-1 (bookworm)	node-mongodb 3.5.6+~cs11.12.19-1 (bookworm)
mongodb	bson	>= 0 < 1.1.4	1.1.4
mongodb	js-bson	< 1.1.4	1.1.4
mongodb_inc	js-bson	1.0 – 1.1.3	—

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N

osv5.4MEDIUM

vendor_debian4.2MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.