muhammara and hummus vulnerable to null pointer dereference on bad response object

높음 7.5CVE-2022-25885 · GHSA-frp9-2v6r-gj97 · Published 01/11/2022 · updated 17/06/2026

요약

CVE-2022-25885은(는) muhammara (muhammara project), hummus, muhammara에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.5%, 전체 취약점의 74.3%보다 높음.
조치: 2.6.0, 1.0.111 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
muhammara muhammara_project	`< 2.6.0`	`2.6.0`
hummus npm	`≥ 1.0.0, < 1.0.111`	`1.0.111`
muhammara npm	`< 2.6.0`	`2.6.0`

Description

The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

NVD description

The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

References

nvd.nist.gov/vuln/detail/CVE-2022-25885 · ADVISORY
galkahana/HummusJS · WEB
julianhille/MuhammaraJS · WEB
galkahana/HummusJS commit a9bf252 · WEB
julianhille/MuhammaraJS commit 0a6427e · WEB
julianhille/MuhammaraJS · PACKAGE
security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139 · WEB
security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137 · WEB

muhammara의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

muhammara

muhammara_project

< 2.6.0

2.6.0

hummus

npm

≥ 1.0.0, < 1.0.111

1.0.111

muhammara

npm

< 2.6.0

2.6.0

Description

The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

NVD description

The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

muhammara의 다른 취약점

모두 보기 →