GHSA-r5xw-q988-826m
Remote Memory Exposure in mongoose
GHSA-r5xw-q988-826m is a medium vulnerability (CVSS 5.1) in mongoose, published September 1, 2020. No source lists public exploit code. Fixed in mongoose 3.8.39.
- Severity
- 5.1 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.8.39mongoose +3 more
Description
Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.
Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.
Recommendation
Update to version 4.3.6, 3.8.39 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected packages
What each source reports
GitHub Advisories Score used
Remote Memory Exposure in mongoose
Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.
Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.
Recommendation
Update to version 4.3.6, 3.8.39 or later.
- Record
GHSA-r5xw-q988-826m- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
OSV
Remote Memory Exposure in mongoose
Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.
Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.
Recommendation
Update to version 4.3.6, 3.8.39 or later.
- Record
GHSA-r5xw-q988-826m- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.