Description
The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | muhammara | unspecified – < 2.6.0 | 2.6.0 |
| — | hummus | < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | hummus | >= 1.0.0, < 1.0.111 | 1.0.111 | GHSA-frp9-2v6r-gj97 |
| npm | muhammara | < 2.6.0 | 2.6.0 | GHSA-frp9-2v6r-gj97 |
References
- https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3091137
- https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091139
- https://github.com/julianhille/MuhammaraJS/commit/0a6427eec82ef2978995e453de2dc0d6224dd46c
- https://github.com/julianhille/MuhammaraJS/issues/188
- https://github.com/galkahana/HummusJS/issues/439