CVE-2018-13863

Name of the Vulnerable Software and Affected Versions MongoDB bson JavaScript module versions 0.5.0 through 1.0.4

Description The issue is related to a Regular Expression Denial of Service (ReDoS) in the lib/bson/decimal128.js file. It occurs when the Decimal128.fromString() function is used to parse a long untrusted string.

Recommendations For MongoDB bson JavaScript module versions 0.5.0 through 1.0.4, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the input to the Decimal128.fromString() function to prevent parsing of long untrusted strings.