CVE-2022-21164 - Denial of Service (DoS)

Back Back to CVE browser

HIGH

Denial of Service (DoS)

Published Mar 16, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.32%

Description

The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.

Affected products

Vendor n/a Product Node-Lmdb Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <0.9.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Node-Lmdb

n/a

Version	Status	Constraints
unspecified	affected	<0.9.7

Ecosystem	Package	Introduced	Fixed
npm	node-lmdb	0	0.9.7

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-241

CWE-703

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1280
Advisory
https://github.com/Venemo/node-lmdb/commit/97760104c0fd311206b88aecd91fa1f59fe2b85a
x_refsource_MISCPatchThird Party Advisory
https://github.com/advisories/GHSA-32j9-6qqm-mq9g
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-21164
https://snyk.io/vuln/SNYK-JS-NODELMDB-2400723
x_refsource_MISCExploitPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1280		Advisory
https://github.com/Venemo/node-lmdb/commit/97760104c0fd311206b88aecd91fa1f59fe2b85a		x_refsource_MISCPatchThird Party Advisory
https://github.com/advisories/GHSA-32j9-6qqm-mq9g		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-21164
https://snyk.io/vuln/SNYK-JS-NODELMDB-2400723		x_refsource_MISCExploitPatchThird Party Advisory