Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mongodb/js-bson

              main @ 8699bb4
            

Fixes

CVEs

HIGH

Peak severity

57.1%

Coverage

Highlights

Buffer Overflow: 3 prior fixes. Scrutinize any change in this area.

src/parser/deserializer.ts: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Buffer Overflow: Multiple fixes address out-of-bounds reads in the deserializer, indicating a persistent weakness in length validation and index arithmetic.

Code Injection: The evalFunctions option allowed arbitrary code execution from BSON data; its removal is critical to prevent injection.

Prototype Pollution: Direct property assignment during deserialization could overwrite __proto__, leading to prototype pollution.