CVE-2018-13863: High severity MongoDB JS-bson vulnerability
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-13863?
CVE-2018-13863 is a vulnerability in the MongoDB bson JavaScript module (js-bson), versions 0.5.0 to 1.0.x before 1.0.5, that allows for a Regular Expression Denial of Service (ReDoS) in the lib/bson/decimal128.js file.
What is the severity of CVE-2018-13863?
The severity of CVE-2018-13863 is high with a CVSS severity score of 7.5.
How does CVE-2018-13863 affect the software?
CVE-2018-13863 affects the MongoDB bson JavaScript module (js-bson) versions 0.5.0 to 1.0.x before 1.0.5, as well as the Mongodb Js-bson package.
What is the fix for CVE-2018-13863?
The fix for CVE-2018-13863 is to update the affected software to version 1.0.5 or later.
Is there any additional information about CVE-2018-13863?
Yes, you can find more information about CVE-2018-13863 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-13863), [GitHub Commit](https://github.com/mongodb/js-bson/commit/bd61c45157c53a1698ff23770160cf4783e9ea4a), [GitHub Advisory](https://github.com/advisories/GHSA-8462-q7x7-g2x4).