CVE-2019-2391— JS-bson may incorrectly serialise some requests
Quick assessment
Affected
MongoDB Inc. js-bson
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BSON是一款计算机数据交换格式，它是用于表示简单或复杂的数据结构、包括关联数组（也称为名称/值对）、整数索引数组和一组基本标量类型的二进制格式。 BSON和BSON 中存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Possible ATT&CK Techniques 1 AI
T1562.001
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-2391
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JS-bson may incorrectly serialise some requests
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
RubyGems BSON 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
BSON是一款计算机数据交换格式，它是用于表示简单或复杂的数据结构、包括关联数组（也称为名称/值对）、整数索引数组和一组基本标量类型的二进制格式。 BSON和BSON 中存在代码问题漏洞。该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MongoDB Inc. | js-bson | 1.0 ~ 1.1.3 | - |
|
II. Public POCs for CVE-2019-2391
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-2391
请登录查看更多情报信息。
Other References for CVE-2019-2391 (1)
-
https://github.com/mongodb/js-bson/releases/tag/v1.1.4 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: MongoDB Inc.
-
CVE-2026-6811
PHP Stack Exhaustion -
CVE-2026-8063
Post-auth null pointer dereference when aggregating against -
CVE-2026-6691
MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow -
CVE-2026-6231
bson_validate may skip validation when processing certain in -
CVE-2025-14847
Zlib compressed protocol header length confusion may allow m
Same weakness: CWE-502
-
CVE-2026-90490
lenve vhr MailReceiver deserialization -
CVE-2026-78175
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object -
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object I -
CVE-2026-87719
Deserialization of Untrusted Data in GitLab -
CVE-2026-62107
WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injec
V. Comments for CVE-2019-2391
No comments yet