Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

mongodb

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.2npmPublished

    MongoDB Driver may publish events containing authentication-related data

    CVE-2021-32050 · GHSA-vxvm-qww3-2fh7

    Affected
    • npm mongodb >= 3.6.0, < 3.6.10; >= 4.0.0, < 4.17.0; >= 5.0.0, < 5.8.0
    Fixed in
    5.8.04.17.03.6.10· Vendor fix available
    Issue
    Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

    Recommended action: Upgrade to 5.8.0, 4.17.0 or 3.6.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. UnratednpmAmendedPublished

    Denial of Service in mongodb

    GHSA-mh5c-679w-hh4r

    Affected
    • npm mongodb < 3.1.13
    Fixed in
    3.1.13· Vendor fix available
    Issue
    Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application. Recommendation Upgrade to version 3.1.13 or later.

    Recommended action: Upgrade to 3.1.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →