CVE-2022-25885: Uncontrolled Resource Consumption

November 1, 2022

The package muhammara before 2.6.0; all versions of package hummus is vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.

References

github.com/galkahana/HummusJS/issues/439
github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c
github.com/julianhille/MuhammaraJS/issues/188
nvd.nist.gov/vuln/detail/CVE-2022-25885
security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139
security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137

Code Behaviors & Features

Detect and mitigate CVE-2022-25885 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →