CVE-2022-36313

MediumCVSS 5.5/10Last modified Oct 7, 2026

Description

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published
Jul 21, 2022
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-363145.5When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requCVE-2022-363154.3When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrieCVE-2022-363166.1When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the targCVE-2022-363176.5When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a permanCVE-2022-363185.3When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESRCVE-2022-363197.5When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vuCVE-2022-36326.5The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to mCVE-2022-363209.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of meCVE-2022-363216.5In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some casesCVE-2022-363228.8In JetBrains TeamCity before 2022.04.2 build parameter injection was possibleCVE-2022-363239.1Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges CVE-2022-363247.5Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypa
CVE-2022-36313: Medium severity, CVSS 5.5 | Vulnix