CVE-2022-21164: Unhandled case in node-lmdb

March 16, 2022 (updated March 28, 2022)

The package node-lmdb before 0.9.7 is vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.

References

github.com/Venemo/node-lmdb/commit/97760104c0fd311206b88aecd91fa1f59fe2b85a
github.com/advisories/GHSA-32j9-6qqm-mq9g
nvd.nist.gov/vuln/detail/CVE-2022-21164
snyk.io/vuln/SNYK-JS-NODELMDB-2400723

Code Behaviors & Features

Detect and mitigate CVE-2022-21164 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →