CVE-2018-13863

    Dashboard / Vulnerabilities / CVE-2018-13863

    CVE-2018-13863

    Published: 10 Jul 2018Last Modified: 8 Jul 2026

    Summary:

    Details: The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.

    References: https://github.com/mongodb/js-bson/commit/bd61c45157c53a1698ff23770160cf4783e9ea4a, https://snyk.io/vuln/npm:bson:20180225

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 323ad7ab19c30e318a367dce5d7859b4622a1e5b
    Fixed -0ea96bd7177839f652393deea69f992136c86f67

    Affected versions

    V1.0.4
    V1.0.3
    V1.0.2
    V1.0.1
    V1.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-13863 | CVE-DB