CVE-2022-25324: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

May 7, 2022 (updated May 24, 2022)

All versions of package bignum is vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.

References

github.com/advisories/GHSA-6429-3g3w-6mw5
github.com/justmoon/node-bignum/blob/ef2e02533e598d6df8421000033c4753cde89ee2/index.js
nvd.nist.gov/vuln/detail/CVE-2022-25324
snyk.io/vuln/SNYK-JS-BIGNUM-2388581

Code Behaviors & Features

Detect and mitigate CVE-2022-25324 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →