GHSA-773h-w45w-f2f9

Denial of service vulnerability exists in libxmljs

Source: GitHub Advisory Database (reviewed) High CVE-2022-21144

Packages

Ecosystem	Package	Affected	Fixed in
npm	libxmljs	< 0.19.8	0.19.8

Details

As written in the advisory (Markdown source, shown as plain text).

libxmljs provides libxml bindings for v8 javascript engine. This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-21144 advisory
https://github.com/libxmljs/libxmljs/pull/594 web
https://github.com/libxmljs/libxmljs/commit/2501807bde9b38cfaed06d1e140487516d91379d web
https://github.com/libxmljs/libxmljs package
https://snyk.io/vuln/SNYK-JS-LIBXMLJS-2348756 web