CVE-2019-19729: Bson-Objectid Project Bson-Objectid

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-input object. As a result, objects in arbitrary forms can bypass formatting if they have a valid bsontype.

Affected products

• Bson-Objectid Project Bson-Objectid: version 1.3.0 only

Published 2019-12-11. Last modified 2026-06-17.