Back to Database
Status published
Medium
CVE-2019-2391
JS-bson may incorrectly serialise some requests
Vulnerability Description
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-2391
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Feng Xiao from Georgia Tech
More from MongoDB Inc.
View All →CVE-2025-14847
Zlib compressed protocol header length confusion may allow memory read
High
8.7
CVE-2025-14345
Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
Low
2.3
CVE-2025-13644
MongoDB may be susceptible to Invariant Failure due to batched delete
High
7.1
CVE-2025-13643
MongoDB Server may allow queries to be terminated by unauthorized users
Low
2.3
CVE-2025-13507
Time-series operations may cause internal BSON size limit to be exceed
High
7.1
Affected Vendor
MongoDB Inc.
View all reports →Affected Software
js-bson
Vulnerable Versions:
1.0
Timeline
Official Publish:
March 31st, 2020
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N