# CVE-2019-2391: MongoDB js-bson deserialization of untrusted data

Source: https://junglewise.ai/threats/cve-2019-2391-mongodb-js-bson-deserialization-of-untrusted-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-2391 · Severity: low · CVSS 3.1 · Published 2022-02-10

The MongoDB js-bson library, which is used to serialize and deserialize BSON (binary JSON) data in Node.js and browser applications, contains a flaw in how it parses certain JSON input. An attacker could craft malicious JSON with an invalid _bsontype field that causes the library to serialize data incorrectly, potentially exposing sensitive information. Organizations using vulnerable versions should upgrade to version 1.1.4 or later.

Technologies: [bson (npm)](https://junglewise.ai/threats/technologies/bson). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-2391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-2391 being exploited in the wild.

**How severe is CVE-2019-2391?** Low severity, with a CVSS score of 3.1, published 10 February 2022.

**Which products and versions are affected?** MongoDB Js-Bson <1.1.4; bson (npm) SEMVER:introduced=0,fixed=1.1.4.

**Is there a fix for CVE-2019-2391?** Yes. bson (npm): upgrade to 1.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-2391 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-2391?** Check whether you run MongoDB Js-Bson or bson (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- bson (npm): upgrade to 1.1.4 or later

  ```sh
  npm install bson@1.1.4
  ```


## Technical details

The vulnerability is a deserialization flaw (CWE-502) in MongoDB's js-bson library affecting versions prior to 1.1.4. The root cause is improper handling of invalid _bsontype fields during BSON serialization of JSON input. An attacker can supply specially crafted JSON with an unrecognized _bsontype value, bypassing expected type validation and causing incorrect serialization behavior. This can lead to data disclosure or unexpected application behavior. The attack requires an application that processes untrusted JSON input with the vulnerable bson library; the exact preconditions (authentication, network accessibility) depend on the application context. A patch was released in version 1.1.4 on March 24, 2020, which properly validates _bsontype fields during serialization.

## Affected products

- MongoDB js-bson <1.1.4

## Identifiers

- CVE-2019-2391
- GHSA-4jwp-vfvf-657p

## Timeline

- 2020-03-31: disclosed: NVD publication date for CVE-2019-2391
- 2020-03-24: patched: MongoDB released js-bson v1.1.4 with fix
- 2022-02-10: advisory: GitHub Security Advisory GHSA-4jwp-vfvf-657p published

## References

- [https://github.com/mongodb/js-bson](https://github.com/mongodb/js-bson)
- [https://github.com/mongodb/js-bson/releases/tag/v1.1.4](https://github.com/mongodb/js-bson/releases/tag/v1.1.4)

## Related threats

- [MongoDB bson deserialization of untrusted data](https://junglewise.ai/threats/cve-2020-7610-mongodb-bson-deserialization-of-untrusted-data)
- [MongoDB js-bson regular expression denial of service](https://junglewise.ai/threats/cve-2018-13863-mongodb-js-bson-regular-expression-denial-of-service)