CVE-2022-25872: Out-of-bounds Read in fast-string-search

June 17, 2022 (updated June 28, 2022)

All versions of package fast-string-search is vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows the attacker to read previously allocated memory.

References

github.com/advisories/GHSA-hmqg-p8f8-3qrw
github.com/magiclen/node-fast-string-search/blob/c8dd9fc966abc80b327f509e63360f59e0de9fb5/src/fast-string-search.c%23L192
nvd.nist.gov/vuln/detail/CVE-2022-25872
snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392368

Code Behaviors & Features

Detect and mitigate CVE-2022-25872 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →