CVE-2019-2391: MongoDB Js-Bson

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.

Affected products

• MongoDB Js-Bson: before 1.1.4 (fixed in 1.1.4)

Published 2020-03-31. Last modified 2026-06-17.