CVE-2022-25852

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-704

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258537.8All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitiza CVE-2022-258545.4This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and a CVE-2022-258557.8All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sani CVE-2022-258567.5The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReade CVE-2022-258577.5The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for c CVE-2022-258587.5The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure CVE-2022-25867.8It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that CVE-2022-258609.8Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemot CVE-2022-258627.5This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing CVE-2022-258639.8The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing i CVE-2022-258647.8Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escala CVE-2022-258659.8The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch