CVE-2022-36313: file-type vulnerable to Infinite Loop via malformed MKV file
(updated )
An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.
References
- github.com/advisories/GHSA-mhxj-85r3-2x55
- github.com/sindresorhus/file-type/commit/2c4d1200c99dffb7d515b9b9951ef43c22bf7e47
- github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254
- github.com/sindresorhus/file-type/releases/tag/v16.5.4
- github.com/sindresorhus/file-type/releases/tag/v17.1.3
- nvd.nist.gov/vuln/detail/CVE-2022-36313
- www.npmjs.com/package/file-type
Code Behaviors & Features
Detect and mitigate CVE-2022-36313 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →