| Package | Affected versions | Patched versions |
|---|---|---|
| mongoose | ≥ 3.5.5, < 3.8.39≥ 4.0.0, < 4.3.6 | 3.8.394.3.6 |
Versions of mongoose before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.
Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.
Update to version 4.3.6, 3.8.39 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free