CVE-2022-39381: Muhammarajs Project Muhammarajs

Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. This issue has been patched in 2.6.0 for muhammara and not at all for hummus. As a workaround, do not process files from untrusted sources.

Affected products

• Muhammarajs Project Muhammarajs: up to and including 2.6.0
• Pdfhummus Hummusjs: before 1.0.111 (fixed in 1.0.111)

Published 2022-11-02. Last modified 2026-06-17.