The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Js-bson | Mongodb | 0.5.0 (including) | 1.0.5 (excluding) |
| Node-mongodb | Ubuntu | trusty | * |
| Node-mongodb | Ubuntu | upstream | * |