CVE-2022-41957

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-690

Affected software

Vendor	Product	Versions
julianhille	MuhammaraJS	< 2.6.2; >= 3.0.0, < 3.4.0

References

https://github.com/julianhille/MuhammaraJS/pull/235Issue Tracking, Patch, Third Party Advisory
https://github.com/julianhille/MuhammaraJS/pull/238Issue Tracking, Patch, Third Party Advisory
https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-2r7v-cmch-5x26Third Party Advisory
https://github.com/julianhille/MuhammaraJS/pull/235Issue Tracking, Patch, Third Party Advisory
https://github.com/julianhille/MuhammaraJS/pull/238Issue Tracking, Patch, Third Party Advisory
https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-2r7v-cmch-5x26Third Party Advisory

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-419587.8super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yam CVE-2022-41964.8The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege use CVE-2022-419604.3BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authentic CVE-2022-419614.3BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could CVE-2022-419622.7BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for set CVE-2022-419633.1BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle del CVE-2022-419645.7BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attack CVE-2022-419656.1Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast'CVE-2022-419667.5XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application wit CVE-2022-419677.5Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XM CVE-2022-419685.3Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated befo CVE-2022-419692.7Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit w