CVE-2018-13863: MongoDB Js-Bson

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.

Affected products

• MongoDB Js-Bson: from 0.5.0, before 1.0.5 (fixed in 1.0.5)

Published 2018-07-10. Last modified 2026-06-17.