CVE-2021-23372

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

VendorProductVersions
n/amongo-express< unspecified

References

Timeline

Published
Apr 13, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-233739.8All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.CVE-2021-233749.8This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attaCVE-2021-233759.8This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attackerCVE-2021-233769.8This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for aCVE-2021-233779.8This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for anCVE-2021-233789.8This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attackerCVE-2021-233799.8This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbCVE-2021-23386.1Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone). Supported versions that CVE-2021-233807.3This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certaCVE-2021-233819.8This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrarCVE-2021-233827.5The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation()CVE-2021-233839.8The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi
CVE-2021-23372: High severity, CVSS 7.5 | Vulnix